Search for vulnerabilities
Vulnerability details: VCID-ubph-7abe-aaab
Vulnerability ID VCID-ubph-7abe-aaab
Aliases CVE-2023-28531
Summary ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints.
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3 9.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28531.json
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00104 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00145 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.02902 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.02902 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.02902 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.02902 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.02902 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.02902 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.02902 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.02902 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.02902 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.02902 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.02902 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.02902 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.02902 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.02902 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
epss 0.0681 https://api.first.org/data/v1/epss?cve=CVE-2023-28531
cvssv3 9.8 https://nvd.nist.gov/vuln/detail/CVE-2023-28531
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2023-28531
cvssv3.1 5.9 https://www.debian.org/security/2023/dsa-5586
generic_textual MODERATE https://www.debian.org/security/2023/dsa-5586
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28531.json
https://api.first.org/data/v1/epss?cve=CVE-2023-28531
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AN2UDTXEUSKFIOIYMV6JNI5VSBMYZOFT/
https://security.gentoo.org/glsa/202307-01
https://security.netapp.com/advisory/ntap-20230413-0008/
https://www.debian.org/security/2023/dsa-5586
https://www.openwall.com/lists/oss-security/2023/03/15/8
1033166 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033166
2179334 https://bugzilla.redhat.com/show_bug.cgi?id=2179334
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
cpe:2.3:o:netapp:brocade_fabric_operating_system:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:netapp:brocade_fabric_operating_system:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:solidfire_element_os:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:netapp:solidfire_element_os:-:*:*:*:*:*:*:*
CVE-2023-28531 https://nvd.nist.gov/vuln/detail/CVE-2023-28531
USN-6560-1 https://usn.ubuntu.com/6560-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28531.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-28531
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-28531
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://www.debian.org/security/2023/dsa-5586
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.11503
EPSS Score 0.0004
Published At May 1, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.