CVE-2023-38335
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
Omnis Studio 10.22.00 has incorrect access control, allowing 'always private' Omnis libraries to be opened. Although this feature is supposed to be an irreversible operation, implementation issues allow bypassing specific checks.
Risk Assessment
Organizations may be exposed to unauthorized access to sensitive data, potentially leading to privacy breaches and information security issues.
Recommendation
It is recommended to update to the latest version of Omnis Studio to fix access control issues and ensure libraries are truly private.
Original NVD description (English source)
Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries "always private" - this is supposed to be an irreversible operation. However, due to implementation issues, "always private" Omnis libraries can be opened by the Omnis Studio browser by bypassing specific checks. This violates the expected behavior of an "irreversible operation".