CVE-2023-32289
Assigner: icscert
Published: 2023-06-06T15:13:13.877Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Cscape
vendor: Horner Automation
versions: status: affected
version: v9.90 SP8
defaultStatus: unaffected
product: Cscape EnvisionRV
vendor: Horner Automation
versions: status: affected
version: v4.70
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Michael Heinzl reported these vulnerabilities to CISA. 
datePublic: 2023-05-23T17:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">

<span style="background-color: rgb(255, 255, 255);">

<span style="background-color: rgb(255, 255, 255);">

<span style="background-color: rgb(255, 255, 255);">

<span style="background-color: rgb(255, 255, 255);">

<span style="background-color: rgb(255, 255, 255);">The affected application lacks proper validation of user-supplied data when parsing project files (e.g.., CSP). This could lead to an out-of-bounds read in IO_CFG. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. </span>

</span>

 </span>

</span>

</span>

</span>


value: 










The affected application lacks proper validation of user-supplied data when parsing project files (e.g.., CSP). This could lead to an out-of-bounds read in IO_CFG. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. 



 








metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-125
description: CWE-125 Out-of-bounds Read
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 



<p>Horner Automation recommends upgrading the following software: </p><ul><li>Cscape: Update to <a target="_blank" rel="nofollow" href="https://hornerautomation.com/cscape-software/">v9.90 SP9</a>&nbsp;</li><li>Cscape Envision RV: Update to <a target="_blank" rel="nofollow" href="https://hornerautomation.com/product/cscape-envision-rv/">v4.80</a>&nbsp;</li></ul>
value: 


Horner Automation recommends upgrading the following software: 

  *  Cscape: Update to  v9.90 SP9 https://hornerautomation.com/cscape-software/  
  *  Cscape Envision RV: Update to  v4.80 https://hornerautomation.com/product/cscape-envision-rv/  



source: advisory: ICSA-23-143-04
discovery: EXTERNAL
x_generator: engine: Vulnogram 0.1.0-dev