PT-2024-14036 · Td Bank · Td Advanced Dashboard Client

Published 2024-02-21 · Updated 2025-05-06 · CVE-2023-50975

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TD Bank TD Advanced Dashboard client through 3.0.3 for macOS

Description The issue allows arbitrary code execution due to the lack of electron::fuses::IsRunAsNodeEnabled, which means ELECTRON RUN AS NODE can be used in production. This makes it easier for a compromised process to access banking information.

Recommendations For TD Bank TD Advanced Dashboard client through 3.0.3 for macOS, consider disabling the use of ELECTRON RUN AS NODE in production until a patch is available. Restrict access to sensitive banking information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2023-50975

Affected Products

Td Advanced Dashboard Client

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-50975 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50975 · Vendor Advisory
• https://t.me/cvenotify/93232 · Telegram Post
• https://t.me/cvenotify/72119 · Telegram Post
• https://newsroom.ripeda.com/tag/macs-for-business · Note
• https://electronjs.org/blog/statement-run-as-node-cves · Note
• https://gist.github.com/khronokernel/2598c067d0f49b0f0a4c8b01cf129d34 · Note
• https://t.me/cvenotify/121053 · Telegram Post
• https://twitter.com/CVEnew/status/1760376925439082770 · Twitter Post