Medium severity6.5NVD Advisory· Published Jul 13, 2023· Updated Jun 17, 2026
CVE-2023-35833
CVE-2023-35833
Description
An issue was discovered in YSoft SAFEQ 6 Server before 6.0.82. When modifying the URL of the LDAP server configuration from LDAPS to LDAP, the system does not require the password to be (re)entered. This results in exposing cleartext credentials when connecting to a rogue LDAP server. NOTE: the vendor originally reported this as a security issue but then reconsidered because of the requirement for Admin access in order to change the configuration.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:h:ysoft:safeq_server:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:h:ysoft:safeq_server:*:*:*:*:*:*:*:*range: >=6.0,<6.0.82
- (no CPE)range: <6.0.82
- YSoft/SAFEQ 6 Serverdescription
Patches
Vulnerability mechanics
References
2- www.ysoft.com/en/legal/ldaps-encryption-downgrade-attack-vulnerabilitynvdVendor Advisory
- ysoft.comnvdProduct
News mentions
0No linked articles in our index yet.