PT-2023-4195 · Pro Face · Gp-Pro Ex

Published 2023-08-08 · Updated 2023-08-15 · CVE-2023-3953

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GP-Pro EX (affected versions not specified)

Description The issue is related to a memory buffer overflow, which could allow an attacker to impact the confidentiality, integrity, and availability of protected information. This occurs when an authenticated user opens a tampered log file from GP-Pro EX, potentially causing memory corruption. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2023-04510

CVE-2023-3953

Affected Products

Gp-Pro Ex

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-3953 · Security Note
• https://bdu.fstec.ru/vul/2023-04510 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-220-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-220-01.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-3953 · Vendor Advisory
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-220-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-220-01.pdf · Note
• https://t.me/cibsecurity/68099 · Telegram Post
• https://t.me/cvenotify/56104 · Telegram Post