What’s Vulnerable › Vulnerabilities

CVE-2023-38994

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-31 · updated 2026-06-17
• Weakness: CWE-668

Description

The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuration of UCS does not allow local ssh access for regular users.

Affected products

• Univention Corporate Server univention-directory-notifier: 5.0

References

• https://forge.univention.org/bugzilla/show_bug.cgi?id=56324
• https://forge.univention.org/bugzilla/show_bug.cgi?id=56324#c0
• https://raeph123.github.io/BlogPosts/Univention/Simple_yet_effective_The_story_of_some_simple_bugs_that_led_to_the_complete_compromise_of_a_network_en.html
• https://www.drive-byte.de/en/blog/simple-yet-effective-the-story-of-some-simple-bugs-that-led-to-the-complete-compromise-of-a-network
• https://forge.univention.org/bugzilla/show_bug.cgi?id=56324
• https://forge.univention.org/bugzilla/show_bug.cgi?id=56324#c0
• https://www.drive-byte.de/en/blog/simple-yet-effective-the-story-of-some-simple-bugs-that-led-to-the-complete-compromise-of-a-network

Get alerted when CVE-2023-38994 or the next vulnerability affects your stack