Cyber Resilience

CVE-2023-34968

Info Disclosure in Samba ≤ 4.16.11

Published
20 July 2023
Modified
06 December 2024
Patch / advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.013 68th percentile
Risk Priority 48 floored blend · peak EPSS

Summary

CVE-2023-34968 is a medium-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Samba Samba. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked in the top 32% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker…

more

with a targeted RPC request to view the information that is part of the disclosed path.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1040 Network Sniffing Credential Access
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.
T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-34966Same product: Debian Debian Linux
CVE-2023-34967Same product: Debian Debian Linux
CVE-2023-3347Same product: Fedoraproject Fedora
CVE-2026-1539Same product: Redhat Enterprise Linux
CVE-2023-3961Same product: Fedoraproject Fedora
CVE-2023-4091Same product: Fedoraproject Fedora
CVE-2025-32635Shared CWE-201
CVE-2025-49584Shared CWE-201
CVE-2024-41931Shared CWE-201
CVE-2023-3102Shared CWE-201

Affected Assets

samba
samba
≤ 4.16.11 · 4.17.0 — 4.17.10 · 4.18.0 — 4.18.5
fedoraproject
fedora
37, 38
redhat
storage
3.0
redhat
enterprise linux
8.0, 9.0
debian
debian linux
11.0, 12.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
  • V14.2.3

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-201

Embedding taints allows detection when sensitive data is inserted into outbound or sent data streams.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent insertion of sensitive data into application outputs and messages.

DE.CM-09 partial match
prevents

Monitoring runtime data flows and outputs can detect sensitive data being transmitted.

PR.DS-02 partial match
prevents

Protecting data-in-transit can include filtering or encrypting to avoid exposing sensitive content.

PR.DS-10 partial match
prevents

Protecting data-in-use includes removing confidential values before they are processed or sent.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Data-masking techniques can prevent sensitive values from appearing in transmitted payloads.

mitigates

Classification identifies sensitive data so it is not inadvertently transmitted.

mitigates

Labelling makes sensitive data visible to developers and prevents accidental inclusion in outbound messages.

mitigates

Information-transfer rules directly govern what data may be sent to external parties.

mitigates

PII-protection requirements reduce the chance of sending personal data to unauthorized recipients.

mitigates

DLP controls inspect and block outbound flows that contain sensitive information.

References