CVE-2023-45083 MEDIUM

CVE-2023-45083: HyperCloud: "admin" and "serveradmin" users can be deleted

Vendor Softiron
Product HyperCloud
Weakness CWE-269
Published December 5, 2023
Last update August 2, 2024

CVSS base score

4.2/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane. An authenticated admin-level user may be able to delete the "admin" or "serveradmin" users, which prevents authentication from subsequently succeeding. This issue affects HyperCloud versions 1.0 to any release before 2.1.

Key dates

02Disclosure timeline

December 5, 2023 CVE published
August 2, 2024 Record updated