PT-2023-25890 · Hgiga · Isherlock

Cyku · Published 2023-07-21 · Updated 2023-08-04 · CVE-2023-37292

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HGiga iSherlock versions 4.5 before iSherlock-user-4.5-174 HGiga iSherlock versions 5.5 before iSherlock-user-5.5-174

Description The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as 'OS Command Injection'. This allows OS Command Injection in HGiga iSherlock.

Recommendations For HGiga iSherlock versions 4.5 before iSherlock-user-4.5-174, update to a version after iSherlock-user-4.5-174. For HGiga iSherlock versions 5.5 before iSherlock-user-5.5-174, update to a version after iSherlock-user-5.5-174.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-37292

Affected Products

Isherlock

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-37292 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37292 · Vendor Advisory
• https://twcert.org.tw/tw/cp-132-7239-8fc29-1.html · Note
• https://t.me/cibsecurity/67085 · Telegram Post
• https://t.me/cvenotify/54823 · Telegram Post