CVE-2023-26098

  • Cybersecurity
  • Cybersecurity services
  • Belgium
  • Type Cyber Threat Research

Author: Alexis Pain
Published: 24/04/2024

Abstract Advisory Information

The application has a “Open Document” feature that opens the document selected inside the application with the Process.Start function which allows code execution if an executable file is uploaded.

Author: Alexis Pain

 

Version affected

Name: APSAL

Versions: 3.14.2022.235 b

 

Common Vulnerability Scoring System

4.6

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

 

Patches

APSAL 2023.0237

 

References

 

Vulnerability Disclosure Timeline

  • 1/12/2022: Vulnerability discovery
  • 09/01/2023: Vulnerability Report to CERT-XLM
  • 20/01/2023: Vulnerability Report to Vendor through email
  • 17/02/2023: Vendor contacted again for an update
  • 20/02/2023: CVE number assigned: CVE-2023-26098
  • 24/02/2023: CVE ID communicated to vendor and asked for an update regarding the patch.
  • 03/03/2023: Update asked to vendor
  • 23/03/2023: Update received from vendor, use fix APSAL 2023.0237
  • 24/04/2023: Expected Vulnerability disclosure