CVE-2023-3463
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
All versions of GE Digital CIMPLICITY that do not adhere to SDG guidance and accept documents from untrusted sources are vulnerable to memory corruption issues due to insufficient input validation. This includes problems such as out-of-bounds reads and writes, use-after-free, stack-based buffer overflows, uninitialized pointers, and heap-based buffer overflow.
Risk Assessment
Successful exploitation could allow an attacker to execute arbitrary code, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update GE Digital CIMPLICITY to the latest version and implement appropriate input validation mechanisms to minimize the risk associated with accepting documents from untrusted sources.
Original NVD description (English source)
All versions of GE Digital CIMPLICITY that are not adhering to SDG guidance and accepting documents from untrusted sources are vulnerable to memory corruption issues due to insufficient input validation, including issues such as out-of-bounds reads and writes, use-after-free, stack-based buffer overflows, uninitialized pointers, and a heap-based buffer overflow. Successful exploitation could allow an attacker to execute arbitrary code.