CVE-2023-45161

EPSS 0.1%
Published 06.11.2023 13:15:09
Last modified 12.06.2025 15:15:32
Source security@1e.com
Teams watchlist Login
Open Login

The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the URL parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on Windows clients.

To remediate this issue download the updated Network product pack from the 1E Exchange and update the 1E-Exchange-URLResponseTime instruction to v20.1 by uploading it through the 1E Platform instruction upload UI

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

1e ≫ Platform Version < 20.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.1%	0.283

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.2	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
security@1e.com	9.9	3.1	6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://www.1e.com/trust-security-compliance/cve-info/

Vendor Advisory

https://exchange.1e.com/product-packs/network/

Product

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/1e-2023-2003/

https://nvd.nist.gov/vuln/detail/CVE-2023-45161

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-45161

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-45161

EUVD