CVE-2023-37199
MediumCVSS 6.8Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tampers with backups which are then manually restored.
Risk Assessment
This vulnerability poses a risk of remote code execution, potentially leading to serious security breaches in the system.
Recommendation
It is recommended to restrict access to backup restoration functions and implement monitoring mechanisms for administrator actions.
Other vulnerabilities in DCE
See all- CVE-2023-37198Medium
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE uploads or tampers with install packages.
- CVE-2023-37197High
CVE-2023-37197 describes an SQL Injection vulnerability that allows an authenticated user to access unauthorized content, modify or delete content, or perform unauthorized actions by tampering with mass configuration settings of endpoints on DCE.
- CVE-2023-37196High
CVE-2023-37196 describes an SQL Injection vulnerability that allows an authenticated user to access unauthorized content, change or delete content, or perform unauthorized actions by tampering with alert settings on DCE.
Original NVD description (English source)
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tampers with backups which are then manually restored.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS