CVE-2023-NNN

Unauthenticated Remote Code Execution Vulnerability

More information

A vulnerability was discovered  in the web server (backend) component of WithSecure Policy Manager Server and & WithSecure Policy Manager Proxy. An unauthenticated remote user can exploit this perform remote code execution on the client machine.

This issue was reported to WithSecure through the Vulnerability Reward Program. No known exploit or attack has been seen in the wild.

Mitigation: Readme.txt file inside the hotfix7 contains instructions to mitigate risks

NOTE: We have applied for, but not yet received a CVE identifier for this Advisory. We will update the advisory page once we have obtained the CVE number.

Contributors

WithSecure would like to thank following person for bringing this issue to our attention.

Jakob Heusinger from Code White

Changelog

2023-04-05 : Added mitigation steps

    Status

  • Fixed

    • Risk level

  • HIGH

    • Action required

  • Fix : User action is required. The Administrator of the system should download the Hotfix and deploy it to the WithSecure Policy Manager & WithSecure Policy Manager Proxy. Hotfix 7 published to fix this vulnerability. Download and instructions on: https://www.withsecure.com/en/support/product-support/business-suite/policy-manager#download

    • Affected products

  • WithSecure Policy Manager WithSecure Policy Manager for Linux WithSecure Policy Manager Proxy WithSecure Policy Manager Proxy for Linux

    • Platforms

  • All supported platforms for the affected products

    • Date issued

  • 2023-04-04
Read more