PT-2023-29444 · 1E · 1E Platform Saas+1

1E Penetration · Publicado 2023-10-13 · Atualizado 2025-05-20 · CVE-2023-45162

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 1E Platform versions 8.1.2 through 9.0.1 1E Platform SaaS versions prior to 23.7.1

Description The issue is a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Application of the relevant hotfix remediates this issue.

Recommendations For version 8.1.2, apply hotfix Q23166 For version 8.4.1, apply hotfix Q23164 For version 9.0.1, apply hotfix Q23169 For SaaS implementations on version 23.7.1 or later, no action is required as hotfix Q23173 will be automatically applied For SaaS versions below 23.7.1, contact 1E to arrange an urgent upgrade

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-45162

Produtos afetados

1E Platform

1E Platform Saas

Referências · 7

• https://1e.com/trust-security-compliance/cve-info · Aviso do Fabricante
• https://t.me/cvenotify/123036 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-45162 · Nota de Segurança
• https://t.me/cibsecurity/72232 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-45162 · Aviso do Fabricante
• https://t.me/cvenotify/59431 · Publicação no Telegram
• https://teamviewer.com/en/resources/trust-center/security-bulletins/1e-2023-2004 · Nota