CVE-2023-34968: Samba: spotlight server-side share path disclosure
Vulnerability summary
CVE-2023-34968 is a medium (CVSS 5.3) vulnerability in debian debian_linux. EPSS estimates a 1.33% chance of exploitation in the next 30 days, higher than 71.1% of scored vulnerabilities.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 14 · Related 7Timeline
- 20-07-2023PublishedVulnerability first disclosed.
- 20-11-2025Last modifiedVulnerability information updated.
Description
A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
1.33%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.33% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- samba< 2:4.17.10+dfsg-0+deb12u1 | < 2:4.18.5+dfsg-1
- debian_linuxEOL11.0 | 12.0
Redhat2 products
- enterprise_linux8.0 | 9.0
- storage3.0
Fedoraproject1 product
- fedoraEOL37 | 38
Samba1 product
- samba< 4.16.11 | ≥ 4.17.0, < 4.17.10 | ≥ 4.18.0, < 4.18.5
Ubuntu1 product
- sambaAll versions (No fix recorded) | < 2:4.15.13+dfsg-0ubuntu0.20.04.3 | < 2:4.15.13+dfsg-0ubuntu1.2
5 vendors · 7 products
References
15 links- lists.fedoraproject.org/archives/…X Transferred
- lists.fedoraproject.org/archives/…X Transferred
- security.netapp.com/advisory/ntap-20230731-0010/X Transferred
Show all 15 references
www.debian.org/security/2023/dsa-5477X Transferred