CVE-2023-4589 Insufficient verification of data authenticity vulnerability in Delinea Secret Server
An administrator can inject malicious code during software updates due to missing integrity verification in Delinea Secret Server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4589?
CVE-2023-4589 is a critical code injection vulnerability in Delinea Secret Server, published on 6 Sep 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. An attacker with an administrator account could perform software updates without proper integrity verification mechanisms. In this scenario, the update process lacks digital signatures and fails to validate the integrity of the update package, allowing the attacker to inject malicious applications during the update.
Weakness: CWE-345
Which versions are affected by CVE-2023-4589?
It affects 1 product.
Products include Delinea Secret Server.
How do I fix CVE-2023-4589?
No fix has been published for CVE-2023-4589 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-4589 being exploited?
There is no known exploitation of CVE-2023-4589 in the wild and no public exploit code.
Other vulnerabilities in Delinea Secret Server
Sources
Also known as GHSA-985m-g277-8fjr.