CVE-2023-22947 — Uncontrolled Search Path Element in Service Provider

CWE-427 — Uncontrolled Search Path Element4 documents4 sources
Severity
7.3HIGHNVD
EPSS
0.0%
top 89.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Shibboleth Service Provider
Timeline
PublishedJan 11

Description

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt (rather than C:\Program Files) by default. NOTE: the vendor disputes the significance of this report, stating that "We consider the ACLs a best effort thing" and "it was a documentation mistake."

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HExploitability: 1.3 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-fc86-55vx-x268: ** DISPUTED ** Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3↗2023-01-11
▶
CVEList
CVE-2023-22947: Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3↗2023-01-11
▶

📋Vendor Advisories

1
Debian
CVE-2023-22947: shibboleth-sp - Insecure folder permissions in the Windows installation path of Shibboleth Servi...↗2023
▶
CVE-2023-22947 — Uncontrolled Search Path Element | cvebase