CVE-2023-37198
MediumCVSS 6.8Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE uploads or tampers with install packages.
Risk Assessment
This vulnerability poses a risk of remote code execution, potentially allowing unauthorized users to take control of the system.
Recommendation
It is recommended to restrict user permissions and implement verification mechanisms for install packages before uploading.
Other vulnerabilities in DCE
See all- CVE-2023-37199Medium
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tampers with backups which are then manually restored.
- CVE-2023-37197High
CVE-2023-37197 describes an SQL Injection vulnerability that allows an authenticated user to access unauthorized content, modify or delete content, or perform unauthorized actions by tampering with mass configuration settings of endpoints on DCE.
- CVE-2023-37196High
CVE-2023-37196 describes an SQL Injection vulnerability that allows an authenticated user to access unauthorized content, change or delete content, or perform unauthorized actions by tampering with alert settings on DCE.
Original NVD description (English source)
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE uploads or tampers with install packages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS