PT-2023-29442 · 1E · 1E Client+1

Published 2023-10-05 · Updated 2025-05-20 · CVE-2023-45160

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 1E Client versions prior to the version with patch Q23094 1E Client Mac versions prior to v8.1.2.62 1E Client Mac versions between v8.1 and v23.11 (exclusive)

Description In the affected version of the 1E Client, an ordinary user could subvert downloaded instruction resource files, e.g., to substitute a harmful script, by replacing a resource script file created by an instruction at run time with a malicious script. The 1E Client's temporary directory is now locked down in the released patch.

Recommendations For 1E Client versions prior to the version with patch Q23094, apply patch Q23094 to fix the issue. For 1E Client Mac versions prior to v8.1.2.62, re-download the updated version from the 1E Support site. For 1E Client Mac versions between v8.1 and v23.11 (exclusive), upgrade to v23.11 to remediate this vulnerability.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2023-45160

Affected Products

1E Client

1E Client Mac

References · 11

• https://osv.dev/vulnerability/CVE-2023-45160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45160 · Security Note
• https://1e.com/trust-security-compliance/cve-info · Vendor Advisory
• https://teamviewer.com/en/resources/trust-center/security-bulletins/1e-2023-2002 · Note
• https://twitter.com/VulmonFeeds/status/1710005893561995740 · Twitter Post
• https://t.me/cvenotify/123035 · Telegram Post
• https://twitter.com/CVEnew/status/1709954161541099990 · Twitter Post
• https://1e.com/vulnerability-disclosure-policy · Note
• https://t.me/cvenotify/59731 · Telegram Post
• https://1e.my.site.com/s · Note
• https://t.me/cvenotify/60361 · Telegram Post