PT-2024-14875 · Biovia · Biovia Materials Studio

Published 2024-02-01 · Updated 2024-02-09 · CVE-2023-6078

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BIOVIA Materials Studio products from Release BIOVIA 2021 through Release BIOVIA 2023

Description An OS Command Injection issue exists, allowing arbitrary command execution through the upload of a specially crafted perl script.

Recommendations For Release BIOVIA 2021 through Release BIOVIA 2023, consider restricting the upload of perl scripts to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-6078

Affected Products

Biovia Materials Studio

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-6078 · Security Note
• https://3ds.com/vulnerability/advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6078 · Vendor Advisory
• https://t.me/cvenotify/70883 · Telegram Post
• https://t.me/cvenotify/69567 · Telegram Post
• https://twitter.com/CVEnew/status/1753050073641169169 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1753081056993939807 · Twitter Post