CVE-2023-30638

Atos Unify OpenScape SBC 10 before 10R3.1.3, OpenScape Branch 10 before 10R3.1.2, and OpenScape BCF 10 before 10R10.7.0 allow remote authenticated admins to inject commands.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://networks.unify.com/security/advisories/OBSO-2303-02.pdf	Vendor Advisory
https://www.news.de/technik/856818957/unify-openscape-sbc-und-openscape-branch-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/	Press/Media Coverage Third Party Advisory
https://networks.unify.com/security/advisories/OBSO-2303-02.pdf	Vendor Advisory
https://www.news.de/technik/856818957/unify-openscape-sbc-und-openscape-branch-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/	Press/Media Coverage Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:atos:unify_openscape_bcf::::::::
	cpe:2.3:a:atos:unify_openscape_branch::::::::
	cpe:2.3:a:atos:unify_openscape_session_border_controller::::::::

History

07 Feb 2025, 17:15

Type	Values Removed	Values Added
CWE		CWE-94

Information

Published : 2023-04-14 00:15

Updated : 2025-02-07 17:15

NVD link : CVE-2023-30638

Mitre link : CVE-2023-30638

CVE.ORG link : CVE-2023-30638

JSON object : View

Products Affected

atos

unify_openscape_session_border_controller
unify_openscape_branch
unify_openscape_bcf

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2023-30638", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2023-04-14T00:15:18.190", "references": [{"url": "https://networks.unify.com/security/advisories/OBSO-2303-02.pdf", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.news.de/technik/856818957/unify-openscape-sbc-und-openscape-branch-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/", "tags": ["Press/Media Coverage", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://networks.unify.com/security/advisories/OBSO-2303-02.pdf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.news.de/technik/856818957/unify-openscape-sbc-und-openscape-branch-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/", "tags": ["Press/Media Coverage", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Atos Unify OpenScape SBC 10 before 10R3.1.3, OpenScape Branch 10 before 10R3.1.2, and OpenScape BCF 10 before 10R10.7.0 allow remote authenticated admins to inject commands."}], "lastModified": "2025-02-07T17:15:29.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atos:unify_openscape_bcf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "860FB40B-EFA9-4231-86A4-3E04DBCF0B21", "versionEndExcluding": "10r10.7.0", "versionStartIncluding": "10"}, {"criteria": "cpe:2.3:a:atos:unify_openscape_branch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2933BF75-7C65-49AB-A903-888B7DEE8DDC", "versionEndExcluding": "10r3.1.2", "versionStartIncluding": "10"}, {"criteria": "cpe:2.3:a:atos:unify_openscape_session_border_controller:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64637558-A00A-40D0-BDF7-A7EC84F91ED1", "versionEndExcluding": "10r3.1.3", "versionStartIncluding": "10"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}