by Kastro
Paper/Archive/CVE-2023-43762

CVE-2023-43762

withsecure f-secure_policy_manager — Certain WithSecure products allow Unauthenticated Remote Code Execution via the web server (backend).

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 71.7.717 × 2014.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Certain WithSecure products allow Unauthenticated Remote Code Execution via the web server (backend). This affects WithSecure Policy Manager 15 and Policy Manager Proxy 15.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
f-secure_policy_manager15.00–CISA-ADP
f-secure_policy_manager15.00–CISA-ADP
policy_manager_proxy15.00–CISA-ADP
policy_manager_proxy15.00–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwithsecure.com/en/support/security-advisoriesrefwithsecure.com/en/support/security-advisories/cve-2023-nnn511refwithsecure.com/en/support/security-advisories/cve-2023-43762