PT-2024-5380 · Omnivise · Omnivise T3000 Whitelisting Server+5

Published

2024-06-21

·

Updated

2024-11-19

·

CVE-2024-38876

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Omnivise T3000 Application Server R9.2 (All versions) Omnivise T3000 Domain Controller R9.2 (All versions) Omnivise T3000 Product Data Management (PDM) R9.2 (All versions) Omnivise T3000 R8.2 SP3 (All versions) Omnivise T3000 R8.2 SP4 (All versions) Omnivise T3000 Terminal Server R9.2 (All versions) Omnivise T3000 Thin Client R9.2 (All versions) Omnivise T3000 Whitelisting Server R9.2 (All versions)
Description The issue is related to the execution of user-modifiable code as a privileged user, which could allow a local authenticated attacker to execute arbitrary code with elevated privileges. This is due to the affected application regularly executing such code.
Recommendations For Omnivise T3000 Application Server R9.2, consider disabling the execution of user-modifiable code as a temporary workaround until a patch is available. For Omnivise T3000 Domain Controller R9.2, restrict access to user-modifiable code to minimize the risk of exploitation. For Omnivise T3000 Product Data Management (PDM) R9.2, avoid using user-modifiable code in the affected application until the issue is resolved. For Omnivise T3000 R8.2 SP3, consider applying configuration changes to limit the execution of user-modifiable code. For Omnivise T3000 R8.2 SP4, restrict access to the affected application to minimize the risk of exploitation. For Omnivise T3000 Terminal Server R9.2, consider disabling the execution of user-modifiable code as a temporary workaround until a patch is available. For Omnivise T3000 Thin Client R9.2, avoid using user-modifiable code in the affected application until the issue is resolved. For Omnivise T3000 Whitelisting Server R9.2, restrict access to user-modifiable code to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

BDU:2024-06014
CVE-2024-38876

Affected Products

Omnivise T3000 Application Server
Omnivise T3000 Domain Controller
Omnivise T3000 Product Data Management
Omnivise T3000 Terminal Server
Omnivise T3000 Thin Client
Omnivise T3000 Whitelisting Server