CVE-2023-25261
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk77th percentile - higher than 77% of all known CVEs
Summary
A vulnerability in Stimulsoft products allows remote code execution. Versions 2023.1.4 (Designer Desktop) and 2023.1.3 (Designer Web and Viewer Web) do not restrict access to the local file system, enabling an attacker to read and write files and directories. The attacker can also prepare a report with a variable holding gathered data and render it.
Risk Assessment
The risk for the organization includes theft of sensitive data, modification of system files, and potential system takeover through remote code execution.
Recommendation
Immediately update Stimulsoft products to the latest versions that fix this vulnerability. Also restrict application access to trusted users and monitor for unusual activity.
Original NVD description (English source)
Certain Stimulsoft GmbH products are affected by: Remote Code Execution. This affects Stimulsoft Designer (Desktop) 2023.1.4 and Stimulsoft Designer (Web) 2023.1.3 and Stimulsoft Viewer (Web) 2023.1.3. Access to the local file system is not prohibited in any way. Therefore, an attacker may include source code which reads or writes local directories and files. It is also possible for the attacker to prepare a report which has a variable that holds the gathered data and render it in the report.