Lucene search

MitreCVE-2023-28353

HistoryMay 31, 2023 - 12:15 a.m.

CVE-2023-28353

2023-05-3100:15:10

CWE-434

mitre

web.nvd.nist.gov

cve-2023-28353

faronics insight

windows

file upload

code execution

dll exploitation

security vulnerability

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

26.1%

JSON

An issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is able to upload any type of file to any location on the Teacher Console’s computer, enabling a variety of different exploitation paths including code execution. It is also possible for the attacker to chain this vulnerability with others to cause a deployed DLL file to immediately execute as NT AUTHORITY/SYSTEM.

Affected configurations

Nvd

Node

faronicsinsightMatch10.0.19045

AND

microsoftwindowsMatch-

VendorProductVersionCPE
faronicsinsight10.0.19045cpe:2.3:a:faronics:insight:10.0.19045:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
faronics	insight	10.0.19045	cpe:2.3:a:faronics:insight:10.0.19045:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

References

research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/

research.nccgroup.com/?research=Technical%20advisories

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

26.1%

JSON

Related for CVE-2023-28353