Dashboard / CVE-2023-3347

CVE-2023-3347

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 62/100
Published: 2023-07-20 Modified: 2026-11-07 First seen: 2026-11-07 Status: active

Attack Surface

Network No Auth No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: Unchanged
C: None
I: High
A: None

Description

A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data.

Weakness Classification (2)

Affected Software (5)

VendorProductVersion
fedoraproject fedora 38
redhat enterprise_linux 8.0
redhat enterprise_linux 9.0
redhat storage 3.0
samba samba 4.17.0 – 4.17.10

References & Advisories (9)

https://bugzilla.redhat.com/show_bug.cgi?id=2222792
Issue Tracking Third Party Advisory

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction

CVSS Score

5.9 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS — Exploitation Probability

0.44%
Raw Score 0.004360
Percentile 38.4%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00436
2026-11-12
0.00436
2026-11-10
0.00436
2026-11-09
0.00436
2026-11-08
0.00436
2026-11-07
0.00436
2026-11-06
0.00436

Intelligence Sources

mitre ref →
nvd ref →

External Links