CVE-2023-40493

Name of the Vulnerable Software and Affected Versions LG Simple Editor (affected versions not specified)

Description This issue allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. The specific flaw exists within the implementation of the copySessionFolder command, which lacks proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. The vulnerability can be exploited by sending a specially crafted HTTP request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the copySessionFolder command until a patch is available. Restrict access to sensitive directories to minimize the risk of exploitation. Avoid using user-supplied paths in file operations until the issue is resolved.