Vulnerability in Faronics Insight
CVE-2023-28345
An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console password in cleartext via an API endpoint accessible from localhost. Attackers with physical access to the Teacher Console can open a web browser, navigate to the affected endpoint and obtain the teacher's password. This enables them to log into the Teacher Console and begin trivially attacking student machines.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (22.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 22.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Faronics Insight — versions 10.0.19045
- Microsoft Windows
Weakness classification (CWE)
References
- research.nccgroup.com/ (Third Party Advisory)
- research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in… (Exploit, Third Party Advisory, Release Notes, Mitigation)
Frequently asked questions
- What is CVE-2023-28345?
- CVE-2023-28345 is a medium-severity vulnerability in Faronics Insight, classified under Cleartext Storage of Sensitive Information. CVSS score: 4.6/10. Published 2023-05-31.
- How severe is CVE-2023-28345?
- Medium severity. CVSS v3 base score is 4.6 out of 10.