PT-2023-20004 · Stimulsoft · Stimulsoft Viewer+1

Bsc + 4 · Publicado 2023-03-27 · Atualizado 2025-02-19 · CVE-2023-25261

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Stimulsoft Designer (Desktop) version 2023.1.4 Stimulsoft Designer (Web) version 2023.1.3 Stimulsoft Viewer (Web) version 2023.1.3

Description The issue allows for Remote Code Execution, enabling an attacker to access the local file system without restrictions. This can lead to reading or writing local directories and files by including source code. An attacker can also prepare a report with a variable to gather data and render it in the report.

Recommendations For Stimulsoft Designer (Desktop) version 2023.1.4, update to a version that addresses the Remote Code Execution issue. For Stimulsoft Designer (Web) version 2023.1.3, update to a version that addresses the Remote Code Execution issue. For Stimulsoft Viewer (Web) version 2023.1.3, update to a version that addresses the Remote Code Execution issue.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2023-25261

Produtos afetados

Stimulsoft Designer

Stimulsoft Viewer

Referências · 6

• https://cloud-trustit.spp.at/s/Rskwb3jKXQQsJy2 · Nota
• https://t.me/cvenotify/111758 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-25261 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25261 · Aviso do Fabricante
• http://stimulsoft.com · Aviso do Fabricante
• https://cves.at/posts/cve-2023-25261/writeup · Nota