CVE-2023-51772 Security feature bypass in n/a
Attackers can escape Kiosk mode to launch cmd.exe as SYSTEM, enabling privilege escalation and code execution on Windows clients.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-51772?
CVE-2023-51772 is a high-severity vulnerability in n/a, published on 25 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: wait for a session timeout, click on the Help icon, observe that there is a browser window for the One Identity website, navigate to any website that offers file upload, navigate to cmd.exe from the file explorer window, and launch cmd.exe as NT AUTHORITY\SYSTEM.
Weakness: CWE-613
Which versions are affected by CVE-2023-51772?
It affects 1 product.
Products include Oneidentity Password Manager.
How do I fix CVE-2023-51772?
No fix has been published for CVE-2023-51772 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-51772 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-51772 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-vjxw-62pr-vrfg.