CVE-2023-49944

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-49944
The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypass this feature by decrypting the shared key, or by locating the decrypted shared key in process memory. The threat is mitigated by the Agent Protection feature.

6.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.beyondtrust.com/security Vendor Advisory
https://www.beyondtrust.com/trust-center/security-advisories/bt23-08 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:beyondtrust:privilege_management_for_windows:*:*:*:*:*:*:*:*
History

03 Jan 2024, 22:53

Type Values Removed Values Added
CWE NVD-CWE-noinfo
References () https://www.beyondtrust.com/security - () https://www.beyondtrust.com/security - Vendor Advisory
References () https://www.beyondtrust.com/trust-center/security-advisories/bt23-08 - () https://www.beyondtrust.com/trust-center/security-advisories/bt23-08 - Vendor Advisory
CPE cpe:2.3:a:beyondtrust:privilege_management_for_windows:*:*:*:*:*:*:*:*
First Time Beyondtrust
Beyondtrust privilege Management For Windows
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.7

26 Dec 2023, 20:34

Type Values Removed Values Added
Summary
  • (es) La función Challenge Response de BeyondTrust Privilege Management para Windows (PMfW) antes del 14 de julio de 2023 permite a los administradores locales omitir esta función descifrando la clave compartida o localizando la clave compartida descifrada en la memoria de proceso. La amenaza se mitiga mediante la función Agent Protection.

25 Dec 2023, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-25 08:15

Updated : 2024-01-03 22:53

NVD link : CVE-2023-49944

Mitre link : CVE-2023-49944

CVE.ORG link : CVE-2023-49944

JSON object : View

Products Affected

beyondtrust

  • privilege_management_for_windows
CWE
NVD-CWE-noinfo