CVE-2023-3266— CyberPower PowerPanel Business Edition 安全漏洞

N/A

A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentication is selected.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an administrator by selecting LDAP authentication from a hidden HTML combo box. Successful exploitation of this vulnerability also requires the attacker to know at least one username on the device, but any password will authenticate successfully.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

不恰当实现的标准安全检查

CyberPower PowerPanel Business Edition 安全漏洞

Cyber Power Systems CyberPower PowerPanel Business Edition是美国Cyber Power Systems公司的一套电源管理软件。该软件可自动关闭物理和虚拟基础架构、并监控和管理Cyber​​Power UPS系统和网络连接的PDU（电源分配单元）。 Cyber​​Power PowerPanel Enterprise 存在安全漏洞，该漏洞源于允许攻击者在选择 LDAP 身份验证的情况下绕过所有身份验证检查。

N/A

N/A