Lucene search

MitreCVE-2023-49328

HistoryDec 25, 2023 - 6:15 a.m.

CVE-2023-49328

2023-12-2506:15:08

CWE-74

mitre

web.nvd.nist.gov

cve-2023-49328

wolters kluwer

b.point

server

linux

on-premises

remote code execution

argument injection

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.002

Percentile

53.4%

JSON

On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve remote code execution via Argument Injection in the server-to-server module.

Affected configurations

Nvd

Node

linuxlinux_kernelMatch-

AND

wolterskluwerb.pointMatch23.70.00

VendorProductVersionCPE
linuxlinux_kernel-cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
wolterskluwerb.point23.70.00cpe:2.3:a:wolterskluwer:b.point:23.70.00:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
linux	linux_kernel	-	cpe:2.3:o:linux:linux_kernel:-:::::::*
wolterskluwer	b.point	23.70.00	cpe:2.3:a:wolterskluwer:b.point:23.70.00:::::::*

References

www.gruppotim.it/it/footer/red-team.html

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.002

Percentile

53.4%

JSON

Related for CVE-2023-49328