Lucene search

NICVE-2023-5136

HistoryNov 08, 2023 - 4:15 p.m.

CVE-2023-5136

2023-11-0816:15:11

CWE-732

web.nvd.nist.gov

cve-2023-5136

topografix dataplugin

gpx

information disclosure

vulnerability

exploit

data file

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

23.6%

JSON

An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.

Affected configurations

Nvd

Node

nitopografix_data_pluginMatch2023-gpx

Node

nidiademMatch2014

nidiademMatch2015-

nidiademMatch2015sp2

nidiademMatch2017-

nidiademMatch2017sp1

nidiademMatch2018-

nidiademMatch2018sp1

nidiademMatch2019-

nidiademMatch2019sp1

nidiademMatch2020-

nidiademMatch2020sp1

nidiademMatch2021-

nidiademMatch2021sp1

nidiademMatch2022q2

nidiademMatch2022q4

nidiademMatch2023q2

Node

niveristandMatch2013sp1

niveristandMatch2014

niveristandMatch2015-

niveristandMatch2015sp1

niveristandMatch2016

niveristandMatch2017

niveristandMatch2018-

niveristandMatch2018sp1

niveristandMatch2019-

niveristandMatch2019r2

niveristandMatch2019r3

niveristandMatch2019r3f1

niveristandMatch2020-

niveristandMatch2020r2

niveristandMatch2020r3

niveristandMatch2020r4

niveristandMatch2020r5

niveristandMatch2020r6

niveristandMatch2021-

niveristandMatch2021r2

niveristandMatch2021r3

niveristandMatch2023q1

niveristandMatch2023q2

niveristandMatch2023q3

niveristandMatch2023q4

Node

niflexloggerMatch2018r1

niflexloggerMatch2018r2

niflexloggerMatch2018r3

niflexloggerMatch2018r4

niflexloggerMatch2019r1

niflexloggerMatch2019r2

niflexloggerMatch2019r3

niflexloggerMatch2019r4

niflexloggerMatch2020r1

niflexloggerMatch2020r2

niflexloggerMatch2020r3

niflexloggerMatch2020r4

niflexloggerMatch2021r1

niflexloggerMatch2021r2

niflexloggerMatch2021r3

niflexloggerMatch2021r4

niflexloggerMatch2022q2

niflexloggerMatch2022q4

niflexloggerMatch2023q1

niflexloggerMatch2023q2

niflexloggerMatch2023q3

niflexloggerMatch2023q4

VendorProductVersionCPE
nitopografix_data_plugin2023cpe:2.3:a:ni:topografix_data_plugin:2023:-:*:*:*:gpx:*:*
nidiadem2014cpe:2.3:a:ni:diadem:2014:*:*:*:*:*:*:*
nidiadem2015cpe:2.3:a:ni:diadem:2015:-:*:*:*:*:*:*
nidiadem2015cpe:2.3:a:ni:diadem:2015:sp2:*:*:*:*:*:*
nidiadem2017cpe:2.3:a:ni:diadem:2017:-:*:*:*:*:*:*
nidiadem2017cpe:2.3:a:ni:diadem:2017:sp1:*:*:*:*:*:*
nidiadem2018cpe:2.3:a:ni:diadem:2018:-:*:*:*:*:*:*
nidiadem2018cpe:2.3:a:ni:diadem:2018:sp1:*:*:*:*:*:*
nidiadem2019cpe:2.3:a:ni:diadem:2019:-:*:*:*:*:*:*
nidiadem2019cpe:2.3:a:ni:diadem:2019:sp1:*:*:*:*:*:*

Vendor	Product	Version	CPE
ni	topografix_data_plugin	2023	cpe:2.3:a:ni:topografix_data_plugin:2023:-::::gpx::*
ni	diadem	2014	cpe:2.3:a:ni:diadem:2014:::::::*
ni	diadem	2015	cpe:2.3:a:ni:diadem:2015:-::::::
ni	diadem	2015	cpe:2.3:a:ni:diadem:2015:sp2::::::
ni	diadem	2017	cpe:2.3:a:ni:diadem:2017:-::::::
ni	diadem	2017	cpe:2.3:a:ni:diadem:2017:sp1::::::
ni	diadem	2018	cpe:2.3:a:ni:diadem:2018:-::::::
ni	diadem	2018	cpe:2.3:a:ni:diadem:2018:sp1::::::
ni	diadem	2019	cpe:2.3:a:ni:diadem:2019:-::::::
ni	diadem	2019	cpe:2.3:a:ni:diadem:2019:sp1::::::

Rows per page:

1-10 of 641

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "TopoGrafix DataPlugin for GPX",
    "vendor": "NI",
    "versions": [
      {
        "lessThan": "2023 Q4",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "DIAdem",
    "vendor": "NI",
    "versions": [
      {
        "lessThan": "2023 Q2",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "VeriStand",
    "vendor": "NI",
    "versions": [
      {
        "lessThanOrEqual": "2023 Q4",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "FlexLogger",
    "vendor": "NI",
    "versions": [
      {
        "lessThanOrEqual": "2023 Q4",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.ni.com/en/support/documentation/supplemental/23/incorrect-permission-assignment-in-the-topografix-dataplug-for-gpx.html

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

23.6%

JSON

Related for CVE-2023-5136