CVE-2023-0392

EUVD-2023-12453
The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.7 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
3.9 LOW
LOCAL
HIGH
HIGH
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 15%
Affected Products (NVD)
VendorProductVersion
oktaldap_agent
𝑥
< 5.18
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://trust.okta.com/security-advisories/okta-ldap-agent-cve-2023-0392
https://trust.okta.com/security-advisories/okta-ldap-agent-cve-2023-0392