CVE-2023-28503 - CVE House
Back to Database
Status published Unknown CVE-2023-28503

Authentication bypass in UniRPC's udadmin service

Vulnerability Description

Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass authentication checks and execute OS commands as the root user.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-28503

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Ron Bowes

References

More from Rocket Software

View All →
CVE-2023-28509
Weak encryption in UniRPC protocol
Unknown 0
CVE-2023-28508
Heap corruption in UniRPC service
Unknown 0
CVE-2023-28507
Memory exhaustion in LZ4 decompression in UniRPC daemon
Unknown 0
CVE-2023-28506
Stack buffer overflow in UniRPC service
Unknown 0
CVE-2023-28505
Buffer overflow in UniRPC library function
Unknown 0

Affected Vendor

Rocket Software

View all reports →

Affected Software

UniData, UniVerse
Vulnerable Versions:
0

Timeline

Official Publish: March 29th, 2023
Last Modified: February 18th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-798

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1078 Valid Accounts
Persistence
T1021 Remote Services
Lateral Movement
T1190 Exploit Public-Facing Application
Initial Access
T1098 Account Manipulation
Privilege Escalation