User Data Validation Flaw in Product by Vendor
CVE-2023-31244
7.8HIGH
What is CVE-2023-31244?
The affected product exhibits a flaw in validating user-supplied data, specifically when handling maliciously crafted Content Security Policy (CSP) files. This weakness allows an attacker to exploit an uninitialized pointer, leading to arbitrary code execution within the context of the current process. Users are urged to remain vigilant and apply patches to mitigate potential risks associated with this vulnerability. Further details and guidance can be found in the advisory issued by CISA.
Affected Version(s)
Cscape v9.90 SP8
Cscape EnvisionRV v4.70
References
CVSS V3.1
Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Michael Heinzl reported these vulnerabilities to CISA.