CVE-2023-35032

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-35032
Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow command injection by authenticated users, aka OSFOURK-23554.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://networks.unify.com/security/advisories/OBSO-2305-01.pdf Vendor Advisory
https://www.news.de/technik/856882353/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/ Press/Media Coverage
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:atos:unify_openscape_4000_assistant:10:r1:*:*:*:*:*:*
cpe:2.3:a:atos:unify_openscape_4000_assistant:10:r1.34.4:*:*:*:*:*:*
cpe:2.3:a:atos:unify_openscape_4000_manager:10:r1:*:*:*:*:*:*
cpe:2.3:a:atos:unify_openscape_4000_manager:10:r1.34.4:*:*:*:*:*:*
History

No history.

Information

Published : 2023-06-12 02:15

Updated : 2023-06-20 18:26

NVD link : CVE-2023-35032

Mitre link : CVE-2023-35032

CVE.ORG link : CVE-2023-35032

JSON object : View

Products Affected

atos

  • unify_openscape_4000_manager
  • unify_openscape_4000_assistant
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')