CVE-2023-45160 Vulnerability Details

  /     /     /  

CVE-2023-45160 Metadata Quick Info

CVE Published: 05/10/2023 | CVE Updated: 19/09/2024 | CVE Year: 2023
Source: 1E | Vendor: 1E | Product: 1E Client
Status : PUBLISHED

---

CVE-2023-45160 Description

In the affected version of the 1E Client, an ordinary user could subvert downloaded instruction resource files, e.g., to substitute a harmful script. by replacing a resource script file created by an instruction at run time with a malicious script. The 1E Client\'s temporary directory is now locked down in the released patch. Resolution: This has been fixed in patch Q23094  This issue has also been fixed in the Mac Client in updated versions of Non-Windows release v8.1.2.62 - please re-download from the 1E Support site. Customers with Mac Client versions higher than v8.1 will need to upgrade to v23.11 to remediate this vulnerability.

Metrics

CVSS Version: 3.1 | Base Score: 8.8 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* LOW
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-552
CWE Name: CWE-552 Files or Directories Accessible to External Parties
Source: 1E

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-177
CAPEC Description: CAPEC-177 Create files with the same name as files protected with a higher classification


Source: NVD (National Vulnerability Database).