Vulnerabilities > CVE-2023-38994 - Exposure of Resource to Wrong Sphere vulnerability in Univention Corporate Server 5.0
Attack vector
LOCAL Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuration of UCS does not allow local ssh access for regular users.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 1 |
Common Weakness Enumeration (CWE)
References
- https://forge.univention.org/bugzilla/show_bug.cgi?id=56324
- https://forge.univention.org/bugzilla/show_bug.cgi?id=56324
- https://forge.univention.org/bugzilla/show_bug.cgi?id=56324#c0
- https://forge.univention.org/bugzilla/show_bug.cgi?id=56324#c0
- https://www.drive-byte.de/en/blog/simple-yet-effective-the-story-of-some-simple-bugs-that-led-to-the-complete-compromise-of-a-network
- https://www.drive-byte.de/en/blog/simple-yet-effective-the-story-of-some-simple-bugs-that-led-to-the-complete-compromise-of-a-network