← Back

CVE-2023-28345

nvd nist
Published: May 31, 2023Modified: Jan 14, 2025

JSON object

Loading...
4.6
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 0.9 / Impact: 3.6
Source: NVD

Description

An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console password in cleartext via an API endpoint accessible from localhost. Attackers with physical access to the Teacher Console can open a web browser, navigate to the affected endpoint and obtain the teacher's password. This enables them to log into the Teacher Console and begin trivially attacking student machines.

Affected (1)

Products: Faronics: Insight
Faronics
1 product
Insight
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Insight
Version 10.0.19045
Running on/withPlatform Versions
Microsoft
Windows
All versions

Related CWEs

CWE-312
Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References (4)

Source: cve@mitre.org
ExploitMitigationRelease NotesThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMitigationRelease NotesThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.