PT-2023-29277 · Unknown · E-Gov Client Application

Toyama Taku · Published 2023-10-11 · Updated 2023-10-18 · CVE-2023-44689

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions e-Gov Client Application (Windows version) versions prior to 2.1.1.0 e-Gov Client Application (macOS version) versions prior to 1.1.1.0

Description The issue concerns improper authorization in the handler for a custom URL scheme. A crafted URL may direct the product to access an arbitrary website, potentially leading to phishing attacks.

Recommendations For e-Gov Client Application (Windows version) versions prior to 2.1.1.0, update to version 2.1.1.0 or later. For e-Gov Client Application (macOS version) versions prior to 1.1.1.0, update to version 1.1.1.0 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-44689

Affected Products

E-Gov Client Application

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-44689 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44689 · Vendor Advisory
• https://jvn.jp/en/jp/JVN15808274 · Note
• https://shinsei.e-gov.go.jp/contents/news/2023-03-12t1022040900_1318.html · Note
• https://t.me/cvenotify/59228 · Telegram Post
• https://t.me/cibsecurity/72057 · Telegram Post