PT-2023-3304 · Microsoft · Ms Paint+1

Published 2023-05-14 · Updated 2023-05-14

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:P/A:C

Name of the Vulnerable Software and Affected Versions Windows (affected versions not specified)

Description The issue is caused by the lack of termination of script execution after an error is detected in the command line interpreter of the Windows operating system. Exploitation of this issue may allow an attacker to execute arbitrary code by creating an image using the standard capabilities of the MS Paint graphic editor.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-390

Related Identifiers

BDU:2023-03445

Affected Products

Ms Paint

Windows

References · 2

• https://bdu.fstec.ru/vul/2023-03445 · Security Note
• https://tzusec.com/how-to-launch-command-prompt-and-powershell-from-ms-paint · Note