CVE-2023-45351

Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.1, 4000 Assistant V10 R0, 4000 Manager V10 R1 before V10 R1.42.1, and 4000 Manager V10 R0 allow Authenticated Command Injection via AShbr. This is also known as OSFOURK-24039.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://networks.unify.com/security/advisories/OBSO-2306-01.pdf	Vendor Advisory
https://www.news.de/technik/856969401/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/	Press/Media Coverage

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:atos:unify_openscape_4000_assistant:10:r0::::::
	cpe:2.3:a:atos:unify_openscape_4000_assistant:10:r1::::::
	cpe:2.3:a:atos:unify_openscape_4000_manager:10:r0::::::
	cpe:2.3:a:atos:unify_openscape_4000_manager:10:r1::::::

History

No history.

Information

Published : 2023-10-09 04:15

Updated : 2023-10-12 18:36

NVD link : CVE-2023-45351

Mitre link : CVE-2023-45351

CVE.ORG link : CVE-2023-45351

JSON object : View

Products Affected

atos

unify_openscape_4000_manager
unify_openscape_4000_assistant

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2023-45351", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-10-09T04:15:53.947", "references": [{"url": "https://networks.unify.com/security/advisories/OBSO-2306-01.pdf", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.news.de/technik/856969401/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/", "tags": ["Press/Media Coverage"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.1, 4000 Assistant V10 R0, 4000 Manager V10 R1 before V10 R1.42.1, and 4000 Manager V10 R0 allow Authenticated Command Injection via AShbr. This is also known as OSFOURK-24039."}, {"lang": "es", "value": "Atos Unify OpenScape 4000 Assistant V10 R1 anterior a V10 R1.42.1, 4000 Assistant V10 R0, 4000 Manager V10 R1 anterior a V10 R1.42.1 y 4000 Manager V10 R0 permiten la inyecci\u00f3n de comandos autenticados a trav\u00e9s de AShbr. Esto tambi\u00e9n se conoce como OSFOURK-24039."}], "lastModified": "2023-10-12T18:36:25.663", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atos:unify_openscape_4000_assistant:10:r0:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "663FE8C5-3827-4B6D-A598-247D071DB0C3"}, {"criteria": "cpe:2.3:a:atos:unify_openscape_4000_assistant:10:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1AE8D88-E490-4426-8259-04F65409A2F1"}, {"criteria": "cpe:2.3:a:atos:unify_openscape_4000_manager:10:r0:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A81CFBD0-39E6-4CF2-80DA-1785A6625C8E"}, {"criteria": "cpe:2.3:a:atos:unify_openscape_4000_manager:10:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EEB266EB-67B7-4007-A942-D64DB746BB2E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}