PowerShell Information Disclosure Vulnerability

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PowerShell Information Disclosure Vulnerability (CVE-2023-36013)

An update of the powershell package has been released.

The version of Microsoft PowerShell installed on the remote macOS host is 7.2.x prior to 7.2.17, 7.3.x prior to 7.3.10 or 7.4.x prior to 7.4.0. It is, therefore, affected by an information disclosure vulnerability. According to the Microsoft Security Advisory, there exists an unspecified error case in which PowerShell Web cmdlets could disclose authentication information in the error output. An authenticated attacker could exploit this vulnerability to obtain data inside the targeted website like IDs, tokens, nonces, and other sensitive information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
426784	Alpine: powershell: security update to 7.3.10-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
426784	Alpine: powershell: security update to 7.3.10-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
204274	Photon OS 5.0: Powershell PHSA-2023-5.0-0180	Nessus	PhotonOS Local Security Checks	medium
408169	Alpine: powershell: security update to 7.3.10-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
408169	Alpine: powershell: security update to 7.3.10-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
186478	Microsoft PowerShell 7.2.x < 7.2.17 / 7.3.x < 7.3.10 / 7.4.x < 7.4.0 Information Disclosure (macOS)	Nessus	MacOS X Local Security Checks	medium

Detections

Analytics

CVE-2023-36013

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium