CVE-2023-0104

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-0104
The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker to gain control of the user’s computer or gain access to sensitive data.  

9.3 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-23-045-01 Third Party Advisory US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-23-045-01 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:weintek:easybuilder_pro:*:*:*:*:*:*:*:*
cpe:2.3:a:weintek:easybuilder_pro:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:36

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 9.3
References () https://www.cisa.gov/uscert/ics/advisories/icsa-23-045-01 - Third Party Advisory, US Government Resource () https://www.cisa.gov/uscert/ics/advisories/icsa-23-045-01 - Third Party Advisory, US Government Resource

07 Nov 2023, 03:59

Type Values Removed Values Added
Summary The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker to gain control of the user’s computer or gain access to sensitive data. The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker to gain control of the user’s computer or gain access to sensitive data.  
Information

Published : 2023-02-22 21:15

Updated : 2024-11-21 07:36

NVD link : CVE-2023-0104

Mitre link : CVE-2023-0104

CVE.ORG link : CVE-2023-0104

JSON object : View

Products Affected

weintek

  • easybuilder_pro
CWE
CWE-29

Path Traversal: '\..\filename'

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')