Read the docs
TI-2023-04600 Aliases CVE-2023-4997GHSA-hh4p-ff9x-4g5c

Improper authorisation in Uptime DC

Priority MEDIUM 41CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Improper authorisation of regular users in ProIntegra Uptime DC software (versions below 2.0.0.33940) allows them to change passwords of all other users including administrators leading to a privilege escalation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00634 50th percentileScored 2026-11-07
Fix Fixed UptimeDC (ProIntegra S.A.): 2.0.0.33940

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProIntegra S.A.UptimeDCbefore 2.0.0.339402.0.0.33940Patch availableCNA
  • UptimeDC VendorProIntegra S.A. Affected before 2.0.0.33940 Fixed in 2.0.0.33940 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:prointegra:uptimedc:*:*:*:*:*:*:*:*before 2.0.0.33940VulnerableProintegra
  • cpe:2.3:a:prointegra:uptimedc:*:*:*:*:*:*:*:* Versions before 2.0.0.33940 Vulnerable ·Prointegra

Remediation

  • Fix · CNA UptimeDC (ProIntegra S.A.) Fixed in 2.0.0.33940

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-4997
  2. 2026-10-03 Alias added: GHSA-hh4p-ff9x-4g5c
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences