PT-2023-7339 · Kingsoft · Wps Office

Icewall + 2 · Published 2023-11-27 · Updated 2023-12-01 · CVE-2023-31275

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WPS Office version 11.2.0.11537

Description The issue is related to an uninitialized pointer use in the functionality that handles Data elements in an Excel file. This can be exploited by providing a specially crafted malformed file, potentially leading to remote code execution. An attacker can trigger this issue by providing a malicious file.

Recommendations For WPS Office version 11.2.0.11537, consider avoiding the use of the affected Excel file handling functionality until a patch is available. As a temporary workaround, refrain from opening suspicious or untrusted Excel files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Uninitialized Resource

Weakness Enumeration

CWE-457

CWE-908

Related Identifiers

BDU:2023-08370

CVE-2023-31275

Affected Products

Wps Office

References · 9

• https://bdu.fstec.ru/vul/2023-08370 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31275 · Vendor Advisory
• https://safe-surf.ru/upload/VULN-new/VULN.2023-11-29.1.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-31275 · Security Note
• https://t.me/pentestingnews/41476 · Telegram Post
• http://talosintelligence.com/reports/TALOS-2023-1748 · Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1748 · Note
• https://t.me/cvenotify/61838 · Telegram Post
• https://github.com/advisories/GHSA-cfc9-f8qw-f5wh · Note