CVE-2023-22947

CVE-2023-22947 describes a local privilege escalation vulnerability in Shibboleth Service Provider (SP) for Windows versions prior to 3.4.1, affecting both Microsoft Windows and Shibboleth products. The vulnerability stems from insecure folder permissions in the default installation path (C:\opt), allowing an unprivileged local attacker to achieve SYSTEM privileges through DLL planting. With a CVSS score of 7.3 (HIGH), this vulnerability has a low attack complexity and requires no user interaction, but does require local access to the system. There is currently no public exploit code available, no evidence of active exploitation, and minimal community discussion or media coverage, indicating a low immediate threat.