PT-2023-5636 · Withsecure · Withsecure Policy Manager

Published 2023-09-21 · Updated 2023-10-13 · CVE-2023-43764

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WithSecure Policy Manager version 15

Description The issue exists due to insufficient input validation in the WithSecure Policy Manager, allowing an attacker to execute arbitrary code. This can be exploited for unauthenticated remote code execution via the web server backend.

Recommendations For WithSecure Policy Manager version 15, update to a version that includes a fix for this issue, as the current version allows unauthenticated remote code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-06296

CVE-2023-43764

Affected Products

Withsecure Policy Manager

References · 9

• https://bdu.fstec.ru/vul/2023-06296 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-43764 · Security Note
• https://github.com/advisories/GHSA-g7f2-f4hp-4hmj · Note
• https://vuldb.com/ru/?id.240181 · Note
• https://t.me/cvenotify/58380 · Telegram Post
• https://t.me/cvenotify/58400 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1705195575547728169 · Twitter Post
• https://twitter.com/CVEnew/status/1705088141265080506 · Twitter Post
• https://withsecure.com/en/support/security-advisories · Note