CVE-2023-50356

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-50356
SSL connections to some LDAP servers are vulnerable to a man-in-the-middle attack due to improper certificate validation in AREAL Topkapi Vision (Server). This allows a remote unauthenticated attacker to gather sensitive information and prevent valid users from login.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://www.areal-topkapi.com/en/services/security-bulletins Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:areal-topkapi:vision_server:*:*:*:*:*:*:*:*
History

15 Feb 2024, 11:15

Type Values Removed Values Added
Summary (en) SSL connections to NOVELL and Synology LDAP server are vulnerable to a man-in-the-middle attack due to improper certificate validation in AREAL Topkapi Vision (Server). This allows a remote unauthenticated attacker to gather sensitive information and prevent valid users from login. (en) SSL connections to some LDAP servers are vulnerable to a man-in-the-middle attack due to improper certificate validation in AREAL Topkapi Vision (Server). This allows a remote unauthenticated attacker to gather sensitive information and prevent valid users from login.

09 Feb 2024, 01:00

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.1 		v2 : unknown
v3 : 6.5
First Time Areal-topkapi vision Server
Areal-topkapi
CPE cpe:2.3:a:areal-topkapi:vision_server:*:*:*:*:*:*:*:*
References () https://www.areal-topkapi.com/en/services/security-bulletins - () https://www.areal-topkapi.com/en/services/security-bulletins - Vendor Advisory

31 Jan 2024, 14:05

Type Values Removed Values Added
Summary
  • (es) SSL connections to NOVELL and Synology LDAP Server son vulnerables a un ataque de intermediario debido a una validación de certificado incorrecta en AREAL Topkapi Vision (Server). Esto permite que un atacante remoto no autenticado recopile información confidencial e impida que usuarios válidos inicien sesión.

31 Jan 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-31 11:15

Updated : 2024-02-15 11:15

NVD link : CVE-2023-50356

Mitre link : CVE-2023-50356

CVE.ORG link : CVE-2023-50356

JSON object : View

Products Affected

areal-topkapi

  • vision_server
CWE
CWE-295

Improper Certificate Validation