PT-2023-29744 · Qumu · Qumu Multicast Extension V2

Published 2023-10-19 · Updated 2024-09-12 · CVE-2023-45883

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qumu Multicast Extension v2 versions prior to 2.0.63

Description A privilege escalation issue exists within the Qumu Multicast Extension v2 for Windows. When a standard user triggers a repair of the software, a pop-up window opens with SYSTEM privileges. Standard users may use this to gain arbitrary code execution as SYSTEM.

Recommendations For Qumu Multicast Extension v2 versions prior to 2.0.63, update to version 2.0.63 or later to resolve the issue. As a temporary workaround, consider restricting access to the software repair function to prevent standard users from triggering the vulnerability.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-45883

Affected Products

Qumu Multicast Extension V2

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-45883 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45883 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1715012966884524163 · Twitter Post
• https://vidyo.com/enterprise-video-management/qumu · Note
• https://t.me/cvenotify/94422 · Telegram Post
• https://t.me/cvenotify/59733 · Telegram Post
• https://twitter.com/CVEnew/status/1714994701261037642 · Twitter Post
• https://hackandpwn.com/disclosures/CVE-2023-45883.pdf · Note
• https://t.me/cibsecurity/72569 · Telegram Post