CVE-2023-38748

HighCVSS 7.8

Published: 03/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

A use after free vulnerability exists in CX-Programmer included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.

Risk Assessment

The organization may be exposed to sensitive data disclosure or remote code execution, which could lead to serious security implications.

Recommendation

It is recommended to update CX-One to the latest version to mitigate this vulnerability and to restrict opening CXP files from untrusted sources.

Other vulnerabilities in CX-Programmer w CX-One CXONE-AL[][]D-V4 w wersji 9.80 i wcześniejszych

CVE-2023-38747High
CVE-2023-38747 describes a heap-based buffer overflow vulnerability in CX-Programmer included in CX-One CXONE-AL[][]D-V4 version 9.80 and earlier. Opening a specially crafted CXP file by a user may lead to information disclosure and/or arbitrary code execution.

Original NVD description (English source)

Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS