CVE-2023-40501

LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the copyContent command. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. . Was ZDI-CAN-19945.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.zerodayinitiative.com/advisories/ZDI-23-1217/	Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-1217/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lg:simple_editor:3.21.0:*:*:*:*:*:*:*

History

10 Apr 2025, 14:42

Type	Values Removed	Values Added
CWE		NVD-CWE-Other
CPE		cpe:2.3:a:lg:simple_editor:3.21.0:::::::*
First Time		Lg simple Editor Lg
References	~~() https://www.zerodayinitiative.com/advisories/ZDI-23-1217/ -~~	() https://www.zerodayinitiative.com/advisories/ZDI-23-1217/ - Third Party Advisory

Information

Published : 2024-05-03 03:15

Updated : 2025-04-10 14:42

NVD link : CVE-2023-40501

Mitre link : CVE-2023-40501

CVE.ORG link : CVE-2023-40501

JSON object : View

Products Affected

lg

simple_editor

CWE

CWE-749

Exposed Dangerous Method or Function

NVD-CWE-Other

{"id": "CVE-2023-40501", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-05-03T03:15:24.590", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1217/", "tags": ["Third Party Advisory"], "source": "zdi-disclosures@trendmicro.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1217/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "description": [{"lang": "en", "value": "CWE-749"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the copyContent command. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.\n. Was ZDI-CAN-19945."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo de funci\u00f3n peligrosa expuesta de contenido de copia de LG Simple Editor. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en instalaciones afectadas de LG Simple Editor. No se requiere autenticaci\u00f3n para aprovechar esta vulnerabilidad. La falla espec\u00edfica existe en la implementaci\u00f3n del comando copyContent. El problema se debe a una funci\u00f3n peligrosa expuesta. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto de SYSTEM. Fue ZDI-CAN-19945."}], "lastModified": "2025-04-10T14:42:02.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lg:simple_editor:3.21.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFDB5FD9-3D29-48CB-85C5-B96A573E58FC"}], "operator": "OR"}]}], "sourceIdentifier": "zdi-disclosures@trendmicro.com"}