Command Injection Vulnerability in Okta Advanced Server Access Client

CVE-2023-0093

What is CVE-2023-0093?

The Okta Advanced Server Access Client, specifically versions ranging from 1.13.1 to 1.65.0, is affected by a command injection vulnerability stemming from an outdated third-party library, webbrowser. This flaw can be exploited if an attacker successfully tricks a user into providing a specially crafted server URL during the enrollment process. If successfully executed, this could result in the execution of arbitrary commands on the user's system, posing a significant security risk.

References