Lucene search

JpcertCVE-2023-38746

HistoryAug 03, 2023 - 5:15 a.m.

CVE-2023-38746

2023-08-0305:15:10

CWE-125

jpcert

web.nvd.nist.gov

cve-2023-38746

information security

cx-programmer

cx-one

vulnerability

out-of-bounds read

information disclosure

arbitrary code execution

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

37.9%

JSON

Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.

Affected configurations

Nvd

Vulners

Node

omroncx-programmerRange≤9.80

VendorProductVersionCPE
omroncx-programmer*cpe:2.3:a:omron:cx-programmer:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
omron	cx-programmer	*	cpe:2.3:a:omron:cx-programmer::::::::

CNA Affected

[
  {
    "vendor": "OMRON Corporation",
    "product": "CX-Programmer",
    "versions": [
      {
        "version": "Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier",
        "status": "affected"
      }
    ]
  }
]

References

jvn.jp/en/vu/JVNVU93286117/

www.ia.omron.com/product/vulnerability/OMSR-2023-005_en.pdf

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

37.9%

JSON

Related for CVE-2023-38746