CVE-2023-48733

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-48733
An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.

6.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137
https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/2040139
https://lists.debian.org/debian-lts-announce/2024/06/msg00028.html
https://nvd.nist.gov/vuln/detail/CVE-2023-48733
https://www.openwall.com/lists/oss-security/2024/02/14/4
https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137
https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/2040139
https://lists.debian.org/debian-lts-announce/2024/06/msg00028.html
https://nvd.nist.gov/vuln/detail/CVE-2023-48733
https://www.openwall.com/lists/oss-security/2024/02/14/4
Configurations

No configuration.

History

08 May 2025, 16:15

Type Values Removed Values Added
CWE CWE-1188

21 Nov 2024, 08:32

Type Values Removed Values Added
References () https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137 - () https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137 -
References () https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/2040139 - () https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/2040139 -
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00028.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00028.html -
References () https://nvd.nist.gov/vuln/detail/CVE-2023-48733 - () https://nvd.nist.gov/vuln/detail/CVE-2023-48733 -
References () https://www.openwall.com/lists/oss-security/2024/02/14/4 - () https://www.openwall.com/lists/oss-security/2024/02/14/4 -

30 Jun 2024, 23:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00028.html -

14 Feb 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-14 22:15

Updated : 2025-05-08 16:15

NVD link : CVE-2023-48733

Mitre link : CVE-2023-48733

CVE.ORG link : CVE-2023-48733

JSON object : View

Products Affected

No product.

CWE
CWE-1188

Insecure Default Initialization of Resource