What is the CVSS score of CVE-2023-4641?

CVE-2023-4641 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Shadow Utils CVE-2023-4641

MEDIUM

Incorrect Implementation of Authentication Algorithm (CWE-303)

2023-12-27 secalert@redhat.com

Information Disclosure Shadow Utils Codeready Linux Builder Codeready Linux Builder For Arm64 Codeready Linux Builder For Ibm Z Systems Codeready Linux Builder For Power Little Endian Enterprise Linux Enterprise Linux For Arm 64 Enterprise Linux For Ibm Z Systems Enterprise Linux For Power Little Endian

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Dec 27, 2023 - 16:15 nvd

MEDIUM 5.5

DescriptionNVD

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

AnalysisAI

A flaw was found in shadow-utils. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-303. A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory. Affected products include: Shadow-Maint Shadow-Utils, Redhat Codeready Linux Builder, Redhat Codeready Linux Builder For Arm64, Redhat Codeready Linux Builder For Ibm Z Systems, Redhat Codeready Linux Builder For Power Little Endian.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.