Untrusted search path in Perl - CVE-2023-47039

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU83509

Untrusted search path in Perl - CVE-2023-47039

Published: November 27, 2023


Vulnerability identifier: #VU83509
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-47039
CWE-ID: CWE-426
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of an untrusted search path. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData.

The vulnerability affects Windows installations only.


Affected software

Perl
SmartFabric Storage Software
EasyApache

How to mitigate CVE-2023-47039

Install updates from vendor's website.

Perl - update to 5.38.1
SmartFabric Storage Software - update to 1.4.3
EasyApache - update to 4 2023-11-30

External References

Related Security Bulletins