PT-2023-29277 · Unknown · E-Gov Client Application

Toyama Taku · Publicado 2023-10-11 · Atualizado 2023-10-18 · CVE-2023-44689

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions e-Gov Client Application (Windows version) versions prior to 2.1.1.0 e-Gov Client Application (macOS version) versions prior to 1.1.1.0

Description The issue concerns improper authorization in the handler for a custom URL scheme. A crafted URL may direct the product to access an arbitrary website, potentially leading to phishing attacks.

Recommendations For e-Gov Client Application (Windows version) versions prior to 2.1.1.0, update to version 2.1.1.0 or later. For e-Gov Client Application (macOS version) versions prior to 1.1.1.0, update to version 1.1.1.0 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-44689

Produtos afetados

E-Gov Client Application

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-44689 · Nota de Segurança
• https://jvn.jp/en/jp/JVN15808274 · Nota
• https://shinsei.e-gov.go.jp/contents/news/2023-03-12t1022040900_1318.html · Nota
• https://t.me/cvenotify/59228 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-44689 · Aviso do Fabricante
• https://t.me/cibsecurity/72057 · Publicação no Telegram