PT-2023-14564 · Kioware · Kioware

Olnor18 · Published 2023-03-06 · Updated 2023-07-21 · CVE-2022-44875

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions KioWare versions through 8.33

Description The issue allows attackers to obtain SYSTEM access via KioUtils.Execute in JavaScript code because KioWare sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin.

Recommendations For versions through 8.33, update to a version that does not set KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin to prevent attackers from obtaining SYSTEM access via KioUtils.Execute in JavaScript code.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-44875

Affected Products

Kioware

References · 7

• 🔥 https://github.com/olnor18/writeup/tree/master/CVE/CVE-2022-44875 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-44875 · Security Note
• https://osv.dev/vulnerability/CVE-2022-44875 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/8709 · Telegram Post
• https://t.me/cvenotify/45572 · Telegram Post
• https://t.me/cibsecurity/59449 · Telegram Post
• https://kioware.com/versionhistory.aspx?pid=15 · Note