Local File Path Vulnerability in OPSWAT MetaDefender KIOSK
CVE-2023-36658

7.8HIGH

Key Information:

Vendor

Opswat

Status
Media Validation Agent
Metadefender Kiosk
Vendor
CVE Published:
15 September 2023

What is CVE-2023-36658?

A vulnerability exists in OPSWAT MetaDefender KIOSK 4.6.1.9996, where an unquoted service path can be exploited by local attackers. This misconfiguration can lead to the execution of unauthorized commands or scripts, posing a potential security risk for systems running this version. Proper precautions should be taken to mitigate these risks and safeguard sensitive information.

References

https://docs.opswat.com/mdkiosk
https://docs.opswat.com/mdkiosk/release-notes/cve-2023-36658

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.