CVE-2023-34968
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
CVE-2023-34968 is a path disclosure vulnerability in Samba that allows the server-side absolute path of shares, files, and directories to be disclosed in search query results. An attacker can exploit this flaw to view information contained in the disclosed path.
Risk Assessment
Path disclosure can lead to further attacks on the server, allowing attackers to better understand the file system structure and potentially exploit other vulnerabilities.
Recommendation
It is recommended to update Samba to the latest version to mitigate this vulnerability and to restrict access to search functionality for unauthorized users.
Original NVD description (English source)
A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path.