CVE-2023-5012 - OpenCVE

A vulnerability, which was classified as problematic, was found in Topaz OFD 2.11.0.201. This affects an unknown part of the file C:\Program Files\Topaz OFD\Warsaw\core.exe of the component Protection Module Warsaw. The manipulation leads to unquoted search path. Attacking locally is a requirement. Upgrading to version 2.12.0.259 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-239853 was assigned to this vulnerability.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:L/AC:L/Au:S/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Topazevolution	Ofd

Configuration 1 [-]

cpe:2.3:a:topazevolution:ofd:2.11.0.201:*:*:*:*:*:*:*

References

Link	Resource
https://vuldb.com/?ctiid.239853	Third Party Advisory
https://vuldb.com/?id.239853	Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: VulDB

Published: 2023-09-16T20:31:05.407Z

Updated: 2024-01-15T20:26:11.878Z

Reserved: 2023-09-16T06:31:44.432Z

Link: CVE-2023-5012

JSON object: View

NVD Information

Status : Modified

Published: 2023-09-16T21:15:47.887

Modified: 2024-05-17T02:32:45.793

Link: CVE-2023-5012

JSON object: View

Redhat Information

No data.

CWE

CWE-428

{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-5012", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2023-09-16T06:31:44.432Z", "datePublished": "2023-09-16T20:31:05.407Z", "dateUpdated": "2024-01-15T20:26:11.878Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-01-15T20:26:11.878Z"}, "title": "Topaz OFD Protection Module Warsaw core.exe unquoted search path", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-428", "lang": "en", "description": "CWE-428 Unquoted Search Path"}]}], "affected": [{"vendor": "Topaz", "product": "OFD", "versions": [{"version": "2.11.0.201", "status": "affected"}], "modules": ["Protection Module Warsaw"]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as problematic, was found in Topaz OFD 2.11.0.201. This affects an unknown part of the file C:\\Program Files\\Topaz OFD\\Warsaw\\core.exe of the component Protection Module Warsaw. The manipulation leads to unquoted search path. Attacking locally is a requirement. Upgrading to version 2.12.0.259 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-239853 was assigned to this vulnerability."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in Topaz OFD 2.11.0.201 gefunden. Dabei betrifft es einen unbekannter Codeteil der Datei C:\\Program Files\\Topaz OFD\\Warsaw\\core.exe der Komponente Protection Module Warsaw. Durch das Beeinflussen mit unbekannten Daten kann eine unquoted search path-Schwachstelle ausgenutzt werden. Der Angriff muss lokal erfolgen. Ein Aktualisieren auf die Version 2.12.0.259 vermag dieses Problem zu l\u00f6sen. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P"}}], "timeline": [{"time": "2023-09-16T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2023-09-16T00:00:00.000Z", "lang": "en", "value": "CVE reserved"}, {"time": "2023-09-16T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2023-10-03T00:00:00.000Z", "lang": "en", "value": "Countermeasure disclosed"}, {"time": "2024-01-15T21:31:06.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "_Phx (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.239853", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.239853", "tags": ["signature"]}]}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:topazevolution:ofd:2.11.0.201:*:*:*:*:*:*:*", "matchCriteriaId": "3EC9F891-F558-4E0E-8247-F78E6882E1E1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as problematic, was found in Topaz OFD 2.11.0.201. This affects an unknown part of the file C:\\Program Files\\Topaz OFD\\Warsaw\\core.exe of the component Protection Module Warsaw. The manipulation leads to unquoted search path. Attacking locally is a requirement. Upgrading to version 2.12.0.259 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-239853 was assigned to this vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad fue encontrada en Topaz OFD 2.11.0.201 y clasificada como problem\u00e1tica. Una parte desconocida del archivo C:\\Program Files\\Topaz OFD\\Warsaw\\core.exe del componente Protection Module Warsaw afecta a una parte desconocida. La manipulaci\u00f3n conduce a una ruta de b\u00fasqueda sin comillas. Es un requisito atacar localmente. A esta vulnerabilidad se le asign\u00f3 el identificador VDB-239853. NOTA: Se contact\u00f3 primeramente con el proveedor sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2023-5012", "lastModified": "2024-05-17T02:32:45.793", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}]}, "published": "2023-09-16T21:15:47.887", "references": [{"source": "cna@vuldb.com", "tags": ["Third Party Advisory"], "url": "https://vuldb.com/?ctiid.239853"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory"], "url": "https://vuldb.com/?id.239853"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-428"}], "source": "cna@vuldb.com", "type": "Primary"}]}