PT-2023-24825 · Microsoft · Windows Qrc Handler

Mason Corkern · Publicado 2023-07-14 · Atualizado 2023-07-26 · CVE-2023-3434

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jami version 20222284

Description The issue is related to improper input validation in hyperlink interpretation. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger.

Recommendations For Jami version 20222284, consider disabling the hyperlink interpretation feature until a patch is available to prevent exploitation. Restrict access to the Windows QRC Handler to minimize the risk of passing malicious string values. Avoid using custom HTML anchor tags in the Jami messenger until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-3434

Produtos afetados

Windows Qrc Handler

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-3434 · Nota de Segurança
• https://t.me/cvenotify/54371 · Publicação no Telegram
• https://blog.blacklanternsecurity.com/p/Jami-Local-Denial-Of-Service-and-QRC-Handler-Vulnerabilities · Nota
• https://review.jami.net/c/jami-client-qt/+/23569 · Correção
• https://osv.dev/vulnerability/CVE-2023-3434 · Aviso do Fabricante
• https://git.jami.net/savoirfairelinux/jami-client-qt/-/wikis/Changelog#nightly-january-10 · Nota