CVE-2023-51772

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Dec 25, 2023
Updated: Jan 3, 2024
CWE ID 613

Summary

CVE-2023-51772 is a vulnerability in One Identity Password Manager before version 5.13.1. This vulnerability allows for Kiosk Escape, enabling users to reset their Active Directory passwords on the login screen of a Windows client. The product launches a Chromium-based browser in Kiosk mode to provide the reset functionality. To exploit this vulnerability, an attacker would need to wait for a session timeout, click on the Help icon, navigate to a browser window for the One Identity website, then proceed to navigate to any website that offers file upload and launch cmd.exe as NT AUTHORITY\SYSTEM from the file explorer window. This vulnerability poses a high risk as it can lead to unauthorized access and potential compromise of an organization's systems and data. It has a CVSS base score of 8.8 out of 10, indicating its severity.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-51772 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options