CVE-2024-37393

Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.

Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.

Existen múltiples vulnerabilidades de inyecciones LDAP en SecurEnvoy MFA antes de la versión 9.4.514 debido a una validación incorrecta de la entrada proporcionada por el usuario. Un atacante remoto no autenticado podría exfiltrar datos de Active Directory mediante ataques de inyección LDAP ciegos contra el servicio DESKTOP expuesto en el endpoint HTTP /secserver. Esto puede incluir ms-Mcs-AdmPwd, que tiene una contraseña de texto plano para la función Solución de contraseña de administrador local (LAPS).