CVE-2023-0922

Published: Apr 3, 2023Modified: Jun 17, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.

Affected (7)

Products: Samba: Samba

1 product

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Samba Samba	4.0.0 ≤ version < 4.16.10
Samba Samba	4.17.0 ≤ version < 4.17.7
Samba Samba	Version 4.18.0
Samba Samba	Version 4.18.0 rc1
Samba Samba	Version 4.18.0 rc2
Samba Samba	Version 4.18.0 rc3
Samba Samba	Version 4.18.0 rc4

Related CWEs

Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References (8)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXBPYIA4VWNOD437NAHZ3NXKAETLFB5S/

Source: secalert@redhat.com

https://security.gentoo.org/glsa/202309-06

Source: secalert@redhat.com

https://security.netapp.com/advisory/ntap-20230406-0007/

Source: secalert@redhat.com

Third Party Advisory

https://www.samba.org/samba/security/CVE-2023-0922.html

Source: secalert@redhat.com

MitigationVendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXBPYIA4VWNOD437NAHZ3NXKAETLFB5S/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202309-06

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20230406-0007/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.samba.org/samba/security/CVE-2023-0922.html

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

Timeline

No history available yet.