Vulnerabilities > CVE-2023-33254 - Incorrect Authorization vulnerability in Quest Kace Systems Deployment Appliance 9.0.146
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. The captured credentials may provide a higher privilege level on the Active Directory domain. To exploit this, an authenticated attacker edits the user-authentication settings to specify an attacker-controlled LDAP server, clicks the Test Settings button, and captures the cleartext credentials.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |