PT-2023-28991 · Altair · Altair

Masood · Publicado 2023-10-04 · Atualizado 2023-10-10 · CVE-2023-43799

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Altair versions prior to 5.2.5

Description The Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the underlying system and does not isolate the context of the renderer process. This issue affects versions of the software running on MacOS, Windows, and Linux.

Recommendations For versions prior to 5.2.5, update to version 5.2.5 to resolve the issue. As a temporary workaround, consider restricting access to external URLs and isolating the renderer process context until the update is applied.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-43799

GHSA-9M5V-VRF6-FMVM

Produtos afetados

Altair

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43799.json · Exploit
• https://github.com/altair-graphql/altair/releases/tag/v5.2.5 · Nota
• https://github.com/altair-graphql/altair/security/advisories/GHSA-9m5v-vrf6-fmvm · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-43799 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-43799 · Nota de Segurança
• https://t.me/cibsecurity/71637 · Publicação no Telegram
• https://t.me/cvenotify/59208 · Publicação no Telegram