PT-2023-20004 · Stimulsoft · Stimulsoft Viewer+1

Bsc + 4 · Published 2023-03-27 · Updated 2025-02-19 · CVE-2023-25261

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Stimulsoft Designer (Desktop) version 2023.1.4 Stimulsoft Designer (Web) version 2023.1.3 Stimulsoft Viewer (Web) version 2023.1.3

Description The issue allows for Remote Code Execution, enabling an attacker to access the local file system without restrictions. This can lead to reading or writing local directories and files by including source code. An attacker can also prepare a report with a variable to gather data and render it in the report.

Recommendations For Stimulsoft Designer (Desktop) version 2023.1.4, update to a version that addresses the Remote Code Execution issue. For Stimulsoft Designer (Web) version 2023.1.3, update to a version that addresses the Remote Code Execution issue. For Stimulsoft Viewer (Web) version 2023.1.3, update to a version that addresses the Remote Code Execution issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-25261

Affected Products

Stimulsoft Designer

Stimulsoft Viewer

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-25261 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25261 · Vendor Advisory
• http://stimulsoft.com · Vendor Advisory
• https://cloud-trustit.spp.at/s/Rskwb3jKXQQsJy2 · Note
• https://t.me/cvenotify/111758 · Telegram Post
• https://cves.at/posts/cve-2023-25261/writeup · Note