CVE-2023-38994

The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuration of UCS does not allow local ssh access for regular users.

• CWE-668

• https://forge.univention.org/bugzilla/show_bug.cgi?id=56324Issue Tracking, Vendor Advisory
• https://forge.univention.org/bugzilla/show_bug.cgi?id=56324#c0Issue Tracking, Vendor Advisory
• https://raeph123.github.io/BlogPosts/Univention/Simple_yet_effective_The_story_of_some_simple_bugs_that_led_to_the_complete_compromise_of_a_network_en.html
• https://www.drive-byte.de/en/blog/simple-yet-effective-the-story-of-some-simple-bugs-that-led-to-the-complete-compromise-of-a-networkExploit, Technical Description, Third Party Advisory
• https://forge.univention.org/bugzilla/show_bug.cgi?id=56324Issue Tracking, Vendor Advisory
• https://forge.univention.org/bugzilla/show_bug.cgi?id=56324#c0Issue Tracking, Vendor Advisory
• https://www.drive-byte.de/en/blog/simple-yet-effective-the-story-of-some-simple-bugs-that-led-to-the-complete-compromise-of-a-networkExploit, Technical Description, Third Party Advisory

Published

Oct 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38988An issue in the delete function in the OaNotifyController cl…4.3
• CVE-2023-38989An issue in the delete function in the UserController class …4.3
• CVE-2023-3899A vulnerability was found in subscription-manager that allow…7.8
• CVE-2023-38990An issue in the delete function in the MenuController class …4.3
• CVE-2023-38991An issue in the delete function in the ActModelController cl…5.4
• CVE-2023-38992jeecg-boot v3.5.1 was discovered to contain a SQL injection …9.8
• CVE-2023-38995An issue in SCHUHFRIED v.8.22.00 allows remote attacker to o…9.8
• CVE-2023-38996An issue in all versions of Douran DSGate allows a local aut…6.7
• CVE-2023-38997A directory traversal vulnerability in the Captive Portal te…7.2
• CVE-2023-38998An open redirect in the Login page of OPNsense Community Edi…6.1
• CVE-2023-38999A Cross-Site Request Forgery (CSRF) in the System Halt API (…6.5
• CVE-2023-3900An issue has been discovered in GitLab CE/EE affecting all v…7.5