CVE-2023-38747

HighCVSS 7.8

Published: 03/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

CVE-2023-38747 describes a heap-based buffer overflow vulnerability in CX-Programmer included in CX-One CXONE-AL[][]D-V4 version 9.80 and earlier. Opening a specially crafted CXP file by a user may lead to information disclosure and/or arbitrary code execution.

Risk Assessment

The organization may be exposed to sensitive information disclosure and the potential for remote code execution, which could lead to serious security incidents.

Recommendation

It is recommended to update CX-Programmer to the latest version to mitigate the risk associated with this vulnerability and to avoid opening unknown CXP files.

Other vulnerabilities in CX-Programmer w CX-One CXONE-AL[][]D-V4 w wersji 9.80 i wcześniejszych

CVE-2023-38748High
A use after free vulnerability exists in CX-Programmer included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.

Original NVD description (English source)

Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS