What is CVE-2023-35833?

CVE-2023-35833 is a medium-severity vulnerability in Ysoft Safeq Server, classified under Cleartext Transmission of Sensitive Information. CVSS score: 6.5/10. Published 2023-07-13.

How severe is CVE-2023-35833?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Ysoft Safeq Server

CVE-2023-35833

An issue was discovered in YSoft SAFEQ 6 Server before 6.0.82. When modifying the URL of the LDAP server configuration from LDAPS to LDAP, the system does not require the password to be (re)entered. This results in exposing cleartext credentials when connecting to a rogue LDAP server. NOTE: the vendor originally reported this as a security issue but then reconsidered because of the requirement for Admin access in order to change the configuration.

EPSS: 0.003 (26.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Ysoft Safeq_server
N/a — versions n/a

Weakness classification (CWE)

CWE-319 — Cleartext Transmission of Sensitive Information

References

cve@mitre.org (Product)
cve@mitre.org (Vendor Advisory)

Frequently asked questions

What is CVE-2023-35833?: CVE-2023-35833 is a medium-severity vulnerability in Ysoft Safeq Server, classified under Cleartext Transmission of Sensitive Information. CVSS score: 6.5/10. Published 2023-07-13.
How severe is CVE-2023-35833?: Medium severity. CVSS v3 base score is 6.5 out of 10.