Input validation error in Secure Endpoint Private Cloud and Secure Endpoint for Windows - CVE-2023-20084
Published: November 17, 2023
Vulnerability identifier: #VU83232
CSH Severity: Medium
CVSS v4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-20084
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a timing issue that occurs between various software components. A remote user can trick a victim to put a specially crafted file into a specific folder and then persuade the user to execute the file within a limited time window, leading to the endpoint software to fail to quarantine the malicious file or kill its process.
Affected software
Secure Endpoint Private Cloud
Secure Endpoint for Windows
Secure Endpoint for Windows
How to mitigate CVE-2023-20084
Install updates from vendor's website.
Secure Endpoint Private Cloud - update to 4.1
Secure Endpoint for Windows - addressed in versions 7.5.17, 8.2.1.21650
Secure Endpoint for Windows - addressed in versions 7.5.17, 8.2.1.21650