CVE-2023-35034

Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow remote code execution by unauthenticated users, aka OSFOURK-24033.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://networks.unify.com/security/advisories/OBSO-2305-01.pdf	Vendor Advisory
https://www.news.de/technik/856882353/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/	Press/Media Coverage
https://networks.unify.com/security/advisories/OBSO-2305-01.pdf	Vendor Advisory
https://www.news.de/technik/856882353/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/	Press/Media Coverage

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:atos:unify_openscape_4000_assistant:10:r1::::::
	cpe:2.3:a:atos:unify_openscape_4000_assistant:10:r1.34.4::::::
	cpe:2.3:a:atos:unify_openscape_4000_manager:10:r1::::::
	cpe:2.3:a:atos:unify_openscape_4000_manager:10:r1.34.4::::::

History

06 Jan 2025, 18:15

Type	Values Removed	Values Added
CWE		CWE-94

Information

Published : 2023-06-12 02:15

Updated : 2025-01-06 18:15

NVD link : CVE-2023-35034

Mitre link : CVE-2023-35034

CVE.ORG link : CVE-2023-35034

JSON object : View

Products Affected

atos

unify_openscape_4000_assistant
unify_openscape_4000_manager

CWE

NVD-CWE-noinfo CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2023-35034", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-06-12T02:15:48.570", "references": [{"url": "https://networks.unify.com/security/advisories/OBSO-2305-01.pdf", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.news.de/technik/856882353/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/", "tags": ["Press/Media Coverage"], "source": "cve@mitre.org"}, {"url": "https://networks.unify.com/security/advisories/OBSO-2305-01.pdf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.news.de/technik/856882353/unify-openscape-4000-gefaehrdet-it-sicherheitswarnung-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/", "tags": ["Press/Media Coverage"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow remote code execution by unauthenticated users, aka OSFOURK-24033."}], "lastModified": "2025-01-06T18:15:16.923", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atos:unify_openscape_4000_assistant:10:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1AE8D88-E490-4426-8259-04F65409A2F1"}, {"criteria": "cpe:2.3:a:atos:unify_openscape_4000_assistant:10:r1.34.4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2329F029-2272-484D-A808-99BA9B440654"}, {"criteria": "cpe:2.3:a:atos:unify_openscape_4000_manager:10:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EEB266EB-67B7-4007-A942-D64DB746BB2E"}, {"criteria": "cpe:2.3:a:atos:unify_openscape_4000_manager:10:r1.34.4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4752EB9-34A8-4918-B623-C323A9B3E443"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}