CVE-2023-43762

Unauthenticated Remote Code Execution Vulnerability

More information

A vulnerability was discovered  in the web server (backend) component of WithSecure Policy Manager Server and & WithSecure Policy Manager Proxy. An unauthenticated remote user can exploit this perform remote code execution on the client machine.

This issue was reported to WithSecure through the Vulnerability Reward Program. No known exploit or attack has been seen in the wild.

Mitigation: Readme.txt file inside the hotfix7 contains instructions to mitigate risks

Contributors

WithSecure would like to thank following person for bringing this issue to our attention.

Jakob Heusinger from Code White

Changelog

2023-04-05 : Added mitigation steps

    Status

  • Fixed

    • Risk level

  • HIGH

    • Action required

  • Fix : User action is required. The Administrator of the system should download the Hotfix and deploy it to the WithSecure Policy Manager & WithSecure Policy Manager Proxy. Hotfix 7 published to fix this vulnerability. Download and instructions on: https://www.withsecure.com/en/support/product-support/business-suite/policy-manager#download

    • Affected products

  • WithSecure Policy Manager for Windows 15 WithSecure Policy Manager for Linux 15 WithSecure Policy Manager Proxy for Windows 15 WithSecure Policy Manager Proxy for Linux 15

    • Platforms

  • All supported platforms for the affected products

    • Date issued

  • 2023-04-04
Read more