CVE-2023-45353

Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary code on the operating system by leveraging the Common Management Portal web interface for Authenticated remote upload and creation of arbitrary files affecting the underlying operating system. This is also known as OCMP-6591.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://networks.unify.com/security/advisories/OBSO-2306-02.pdf	Vendor Advisory
https://www.news.de/technik/857003738/unify-openscape-common-management-platform-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-update-zu-bekannten-schwachstellen-und-sicherheitsluecken-vom-03-07-2023/1/	Press/Media Coverage

Configurations

Configuration 1 (hide)

cpe:2.3:a:atos:unify_openscape_common_management:10:-:*:*:*:*:*:*

History

No history.

Information

Published : 2023-10-09 04:15

Updated : 2023-10-12 18:35

NVD link : CVE-2023-45353

Mitre link : CVE-2023-45353

CVE.ORG link : CVE-2023-45353

JSON object : View

Products Affected

atos

unify_openscape_common_management

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2023-45353", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-10-09T04:15:54.607", "references": [{"url": "https://networks.unify.com/security/advisories/OBSO-2306-02.pdf", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.news.de/technik/857003738/unify-openscape-common-management-platform-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-update-zu-bekannten-schwachstellen-und-sicherheitsluecken-vom-03-07-2023/1/", "tags": ["Press/Media Coverage"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary code on the operating system by leveraging the Common Management Portal web interface for Authenticated remote upload and creation of arbitrary files affecting the underlying operating system. This is also known as OCMP-6591."}, {"lang": "es", "value": "Atos Unify OpenScape Common Management Portal V10 anterior a V10 R4.17.0 y V10 R5.1.0 permite a un atacante autenticado ejecutar c\u00f3digo arbitrario en el sistema operativo aprovechando la interfaz web del Common Management Portal para carga remota autenticada y creaci\u00f3n de archivos arbitrarios que afectan el sistema operativo subyacente. Esto tambi\u00e9n se conoce como OCMP-6591."}], "lastModified": "2023-10-12T18:35:55.827", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atos:unify_openscape_common_management:10:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FAFA13F-9CC4-4F48-8CE0-ECA83EB2EB9A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}