CVE-2023-22947

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-11 · updated 2026-06-17
Weakness: CWE-427

Description

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt (rather than C:\Program Files) by default. NOTE: the vendor disputes the significance of this report, stating that "We consider the ACLs a best effort thing" and "it was a documentation mistake."

Affected products

Shibboleth Service Provider: before 3.4.1 — fixed in 3.4.1

How to fix

Upgrade to a fixed version: Shibboleth Service Provider 3.4.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-22947 or the next vulnerability affects your stack