CVE-2023-28345

Опубликовано: 31 мая 2023

Источник: nvd

CVSS3: 4.6

EPSS Низкий

Описание

An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console password in cleartext via an API endpoint accessible from localhost. Attackers with physical access to the Teacher Console can open a web browser, navigate to the affected endpoint and obtain the teacher's password. This enables them to log into the Teacher Console and begin trivially attacking student machines.

Ссылки

https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/
Exploit
Mitigation
Release Notes
Third Party Advisory
https://research.nccgroup.com/?research=Technical%20advisories
Third Party Advisory
https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/
Exploit
Mitigation
Release Notes
Third Party Advisory
https://research.nccgroup.com/?research=Technical%20advisories
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:faronics:insight:10.0.19045:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

EPSS

Процентиль: 5%

0.00022

Низкий

4.6 Medium

CVSS3

Дефекты

CWE-312

Связанные уязвимости

GHSA-rwrf-7jj9-g4cp

CVSS3: 4.6

github

больше 2 лет назад

BDU:2023-02950

CVSS3: 4

fstec

около 3 лет назад

Уязвимость компонента Teacher Console платформы управления компьютерными сетями в образовании Faronics Insight, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации