CVE-2023-5964: 1E Platform, невалидиран вход

Описание

Оригинално описание

The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the Caption or Message parameters, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on Windows clients. To remediate this issue DELETE the instruction “Show dialogue with caption %Caption% and message %Message%” from the list of instructions in the Settings UI, and replace it with the new instruction 1E-Exchange-ShowNotification instruction available in the updated End-User Interaction product pack. The new instruction should show as “Show %Type% type notification with header %Header% and message %Message%” with a version of 7.1 or above.

Засегнати продукти

• 1E Platform: до 23

Вид слабост

• CWE-20 Неправилно валидиране на входните данни

История

Други уязвимости в 1E Platform

• 9.9CVE-2023-45163
• 9.9CVE-2023-45161

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2023-5964
• https://nvd.nist.gov/vuln/detail/CVE-2023-5964
• https://exchange.1e.com/product-packs/end-user-interaction/
• https://www.teamviewer.com/en/resources/trust-center/security-bulletins/1e-2023-2006/
• https://www.1e.com/trust-security-compliance/cve-info/