PT-2023-29443 · 1E · 1E-Exchange-Urlresponsetime
CVE-2023-45161
·
Publicado
2023-11-06
·
Atualizado
2025-05-20
CVSS v3.1
9.9
Crítica
| Vetor | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
1E-Exchange-URLResponseTime instruction versions prior to v20.1
Description
The 1E-Exchange-URLResponseTime instruction does not properly validate the
URL parameter, allowing for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on Windows clients.Recommendations
To remediate this issue, download the updated Network product pack from the 1E Exchange and update the 1E-Exchange-URLResponseTime instruction to v20.1 by uploading it through the 1E Platform instruction upload UI.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
1E-Exchange-Urlresponsetime