Vulnerability Details : CVE-2023-40253
Improper Authentication vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Authentication Abuse.This issue affects Genian NAC V4.0: from V4.0.0 through V4.0.155; Genian NAC V5.0: from V5.0.0 through V5.0.42 (Revision 117460); Genian NAC Suite V5.0: from V5.0.0 through V5.0.54; Genian ZTNA: from V6.0.0 through V6.0.15.
Vulnerability category: BypassGain privilege
Products affected by CVE-2023-40253
- cpe:2.3:a:genians:genian_nac:*:*:*:*:-:*:*:*
- cpe:2.3:a:genians:genian_nac:*:*:*:*:-:*:*:*
- cpe:2.3:a:genians:genian_nac:5.0.42:-:*:*:lts:*:*:*
- cpe:2.3:a:genians:genian_nac:5.0.42:revision_117460:*:*:lts:*:*:*
- cpe:2.3:a:genians:genian_ztna:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-40253
0.03%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 9 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-40253
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | |
|
6.0
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N |
1.5
|
4.0
|
KrCERT/CC |
CWE ids for CVE-2023-40253
-
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Assigned by: vuln@krcert.or.kr (Secondary)
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: vuln@krcert.or.kr (Secondary)
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by:
- nvd@nist.gov (Primary)
- vuln@krcert.or.kr (Secondary)
References for CVE-2023-40253
-
https://www.genians.co.kr/notice/2023
지니언스 공식입장문Vendor Advisory
-
https://docs.genians.com/nac/5.0/release/ko/advisories/GN-SA-2023-001.html
GN-SA-2023-001: Genian NAC - Multiple Vulnerabilities — Genians Documentation 5.0.55 documentation
Jump to