What is CVE-2023-4589?

CVE-2023-4589 is a critical-severity vulnerability in Delinea Secret Server, classified under Insufficient Verification of Data Authenticity. CVSS score: 9.1/10. Published 2023-09-06.

How severe is CVE-2023-4589?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in Delinea Secret Server

CVE-2023-4589

Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. An attacker with an administrator account could perform software updates without proper integrity verification mechanisms. In this scenario, the update process lacks digital signatures and fails to validate the integrity of the update package, allowing the attacker to inject malicious applications during the update.

EPSS: 0.003 (18.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Delinea Secret Server — versions v10.9.000002
Delinea Secret_server — versions 10.9.000002

Weakness classification (CWE)

CWE-345 — Insufficient Verification of Data Authenticity

References

cve-coordination@incibe.es (Third Party Advisory)

Frequently asked questions

What is CVE-2023-4589?: CVE-2023-4589 is a critical-severity vulnerability in Delinea Secret Server, classified under Insufficient Verification of Data Authenticity. CVSS score: 9.1/10. Published 2023-09-06.
How severe is CVE-2023-4589?: Critical severity. CVSS v3 base score is 9.1 out of 10.