PT-2023-14564 · Kioware · Kioware

Olnor18 · Publicado 2023-03-06 · Atualizado 2023-07-21 · CVE-2022-44875

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions KioWare versions through 8.33

Description The issue allows attackers to obtain SYSTEM access via KioUtils.Execute in JavaScript code because KioWare sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin.

Recommendations For versions through 8.33, update to a version that does not set KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin to prevent attackers from obtaining SYSTEM access via KioUtils.Execute in JavaScript code.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-44875

Produtos afetados

Kioware

Referências · 7

• 🔥 https://github.com/olnor18/writeup/tree/master/CVE/CVE-2022-44875 · Exploit
• https://t.me/cybersecuritytechnologies/8709 · Publicação no Telegram
• https://t.me/cvenotify/45572 · Publicação no Telegram
• https://t.me/cibsecurity/59449 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-44875 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-44875 · Aviso do Fabricante
• https://kioware.com/versionhistory.aspx?pid=15 · Nota