cvelistv5 - cve-2023-37378

CVE-2023-37378 (GCVE-0-2023-37378)

Vulnerability from cvelistv5

Published

2023-07-03 00:00

Modified

2024-09-05 14:51

Severity ?

CWE

Summary

Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.

References

URL

	Vendor	Product	Version
	n/a	n/a	Version: n/a

icsa-23-222-02

Vulnerability from csaf_cisa

Published

2023-08-08 00:00

Modified

2023-08-08 00:00

Summary

Siemens Parasolid Installer

Notes

Summary

A vulnerability in Nullsoft Scriptable Installer System (NSIS) software (CVE-2023-37378) used in Parasolid installers before V36 creates an “uninstall directory” with insufficient access control. This could allow an attacker to misuse the vulnerability, and potentially escalate privileges. Only systems where Parasolid is installed with a Parasolid installer is impacted. Siemens recommends to uninstall impacted Parasolid instances and reinstall with the latest installer available.

General Recommendations

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.

Legal Notice

All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

Advisory Conversion Disclaimer

This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.

Critical infrastructure sectors

Multiple

Countries/areas deployed

Worldwide

Company headquarters location

Germany

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.

Recommended Practices

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Recommended Practices

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

Recommended Practices

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

Recommended Practices

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

Recommended Practices

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Recommended Practices

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting this vulnerability to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A vulnerability in Nullsoft Scriptable Installer System (NSIS) software (CVE-2023-37378) used in Parasolid installers before V36 creates an \u201cuninstall directory\u201d with insufficient access control. This could allow an attacker to misuse the vulnerability, and potentially escalate privileges. \n\nOnly systems where Parasolid is installed with a Parasolid installer is impacted. Siemens recommends to uninstall impacted Parasolid instances and reinstall with the latest installer available.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-116172.json"
      },
      {
        "category": "self",
        "summary": "SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-116172.html"
      },
      {
        "category": "self",
        "summary": "SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-116172.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-116172.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-222-02 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-222-02.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-222-02 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-222-02"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens Parasolid Installer",
    "tracking": {
      "current_release_date": "2023-08-08T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-23-222-02",
      "initial_release_date": "2023-08-08T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2023-08-08T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Parasolid V35.0",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "Parasolid V35.0"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Parasolid V35.1",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "Parasolid V35.1"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-37378",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Nullsoft Scriptable Install System (NSIS) before v3.09 creates an \"uninstall directory\" with insufficient access control. This could allow an attacker to misuse the vulnerability, and potentially escalate privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Run the uninstaller to remove the vulnerable directory and reinstall with the latest installer available for download",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://support.sw.siemens.com/en-US/product/258316782/"
        },
        {
          "category": "workaround",
          "details": "Scan each computer where Parasolid has ever been installed with an up-to-date anti-virus program and follow its recommendations",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-37378"
    }
  ]
}

ICSA-23-222-02

Vulnerability from csaf_cisa

Published

2023-08-08 00:00

Modified

2023-08-08 00:00

Summary

Siemens Parasolid Installer

Notes

Summary

General Recommendations

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Legal Notice

Advisory Conversion Disclaimer

This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.

Critical infrastructure sectors

Multiple

Countries/areas deployed

Worldwide

Company headquarters location

Germany

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.

Recommended Practices

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Recommended Practices

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

Recommended Practices

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

Recommended Practices

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting this vulnerability to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A vulnerability in Nullsoft Scriptable Installer System (NSIS) software (CVE-2023-37378) used in Parasolid installers before V36 creates an \u201cuninstall directory\u201d with insufficient access control. This could allow an attacker to misuse the vulnerability, and potentially escalate privileges. \n\nOnly systems where Parasolid is installed with a Parasolid installer is impacted. Siemens recommends to uninstall impacted Parasolid instances and reinstall with the latest installer available.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-116172.json"
      },
      {
        "category": "self",
        "summary": "SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-116172.html"
      },
      {
        "category": "self",
        "summary": "SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-116172.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-116172.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-222-02 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-222-02.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-222-02 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-222-02"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens Parasolid Installer",
    "tracking": {
      "current_release_date": "2023-08-08T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-23-222-02",
      "initial_release_date": "2023-08-08T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2023-08-08T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Parasolid V35.0",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "Parasolid V35.0"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Parasolid V35.1",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "Parasolid V35.1"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-37378",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Nullsoft Scriptable Install System (NSIS) before v3.09 creates an \"uninstall directory\" with insufficient access control. This could allow an attacker to misuse the vulnerability, and potentially escalate privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Run the uninstaller to remove the vulnerable directory and reinstall with the latest installer available for download",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://support.sw.siemens.com/en-US/product/258316782/"
        },
        {
          "category": "workaround",
          "details": "Scan each computer where Parasolid has ever been installed with an up-to-date anti-virus program and follow its recommendations",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2023-37378"
    }
  ]
}

ghsa-5r79-3284-v2f8

Vulnerability from github

Published

2023-07-03 21:30

Modified

2023-07-11 18:31

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Details

Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-37378"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-03T20:15:09Z",
    "severity": null
  },
  "details": "Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.",
  "id": "GHSA-5r79-3284-v2f8",
  "modified": "2023-07-11T18:31:20Z",
  "published": "2023-07-03T21:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37378"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM"
    },
    {
      "type": "WEB",
      "url": "https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09"
    },
    {
      "type": "WEB",
      "url": "https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released"
    },
    {
      "type": "WEB",
      "url": "http://sf.net/p/nsis/bugs/1296"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

gsd-2023-37378

Vulnerability from gsd

Modified

2023-12-13 01:20

Details

Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.

Aliases

CVE-2023-37378

Aliases

CVE-2023-37378

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-37378",
    "id": "GSD-2023-37378"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-37378"
      ],
      "details": "Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.",
      "id": "GSD-2023-37378",
      "modified": "2023-12-13T01:20:24.664312Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2023-37378",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://sf.net/p/nsis/bugs/1296",
            "refsource": "MISC",
            "url": "http://sf.net/p/nsis/bugs/1296"
          },
          {
            "name": "https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09",
            "refsource": "MISC",
            "url": "https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09"
          },
          {
            "name": "https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/",
            "refsource": "MISC",
            "url": "https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/"
          },
          {
            "name": "https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967",
            "refsource": "MISC",
            "url": "https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967"
          },
          {
            "name": "https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467",
            "refsource": "MISC",
            "url": "https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467"
          },
          {
            "name": "https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0",
            "refsource": "MISC",
            "url": "https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0"
          },
          {
            "name": "[debian-lts-announce] 20230707 [SECURITY] [DLA 3483-1] nsis security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html"
          },
          {
            "name": "FEDORA-2023-dfb6cc599f",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM/"
          },
          {
            "name": "FEDORA-2023-b9ec99605f",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.09",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2023-37378"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967"
            },
            {
              "name": "https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/",
              "refsource": "MISC",
              "tags": [
                "Release Notes"
              ],
              "url": "https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/"
            },
            {
              "name": "https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09",
              "refsource": "MISC",
              "tags": [
                "Release Notes"
              ],
              "url": "https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09"
            },
            {
              "name": "https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467"
            },
            {
              "name": "https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0"
            },
            {
              "name": "http://sf.net/p/nsis/bugs/1296",
              "refsource": "MISC",
              "tags": [
                "Issue Tracking",
                "Permissions Required"
              ],
              "url": "http://sf.net/p/nsis/bugs/1296"
            },
            {
              "name": "[debian-lts-announce] 20230707 [SECURITY] [DLA 3483-1] nsis security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html"
            },
            {
              "name": "FEDORA-2023-b9ec99605f",
              "refsource": "FEDORA",
              "tags": [],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK/"
            },
            {
              "name": "FEDORA-2023-dfb6cc599f",
              "refsource": "FEDORA",
              "tags": [],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2023-07-13T23:15Z",
      "publishedDate": "2023-07-03T20:15Z"
    }
  }
}

CERTFR-2023-AVI-0633

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

SICAM TOOLBOX II versions antérieures à 07.10
Périphériques RUGGEDCOM ROS versions antérieures à 4.3.8
Solid Edge SE2023 versions antérieures à 223.0 Update 7
RUGGEDCOM CROSSBOW versions antérieures à 5.4
Parasolid versions 34.1.x antérieures à 34.1.258
Parasolid versions 35.0.x antérieures à 35.0.254
Parasolid versions 35.1.x antérieures à 35.1.197
Teamcenter Visualization versions 14.1.x, se référer à l'avis éditeur pour plus d'information sur les mesures de contournement
Teamcenter Visualization versions 14.2.x antérieures à 14.2.0.6
Teamcenter Visualization versions 14.3.x, se référer à l'avis éditeur pour plus d'information sur les mesures de contournement
SIMATIC contrôleur de disque CPU 1504D versions antérieures à 3.0.3
SIMATIC contrôleur de disque CPU 1507D versions antérieures à 3.0.3
SIMATIC ET toutes versions
SIMATIC IPC toutes versions
SIMATIC S7 versions antérieures à 3.0.3
SIPLUS ET versions antérieures à 3.3.19
SIPLUS S7 versions antérieures à 3.0.3
Siemens Software Center versions antérieures à 3.0
APOGEE PXC Compact versions antérieures à 3.5.5
APOGEE PXC Compact (P2 Ethernet) versions antérieures à 2.8.20
APOGEE PXC Modular (BACnet) versions antérieures à 3.5.5
APOGEE PXC Modular (P2 Ethernet) versions antérieures à 2.8.20
TALON TC Compact versions antérieures à 3.5.5
TALON TC Modular (BACnet) versions antérieures à 3.5.5
JT2Go versions antérieures à 14.2.0.5
Solid Edge SE2022 versions antérieures à 222.0 Update 13
Solid Edge SE2023 versions antérieures à 223.0 Update 4
Teamcenter Visualization versions 13.2.x antérieures à 13.2.0.15
Teamcenter Visualization versions 13.3.x antérieures à 13.3.0.11
Teamcenter Visualization versions 14.1.x antérieures à 14.1.0.11
Teamcenter Visualization versions 14.2.x antérieures à 14.2.0.5
Parasolid versions 35.0.x sans la procédure de réinstallation
Parasolid versions 35.1.x sans la procédure de réinstallation
JT Open versions antérieures à 11.4
JT Utilities versions antérieures à 13.4
Parasolid versions 34.0.x antérieures à 34.0.253
Parasolid versions 34.1.x antérieures à 34.1.243
Parasolid versions 35.0.x antérieures à 35.0.177
Parasolid versions 35.1.x antérieures à 35.1.073

L'éditeur ne propose pas de correctif pour certains produits RUGGEDCOM ROS, SIMATIC ou SIPLUS, se référer aux avis pour obtenir plus d'informations sur les mesures de contournement.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

fkie_cve-2023-37378

Vulnerability from fkie_nvd

Published

2023-07-03 20:15

Modified

2024-11-21 08:11

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.

References

URL	Tags
cve@mitre.org	http://sf.net/p/nsis/bugs/1296	Issue Tracking, Permissions Required
cve@mitre.org	https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967	Patch
cve@mitre.org	https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467	Patch
cve@mitre.org	https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0	Patch
cve@mitre.org	https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html	Mailing List, Third Party Advisory
cve@mitre.org	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK/
cve@mitre.org	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM/
cve@mitre.org	https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09	Release Notes
cve@mitre.org	https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/	Release Notes
af854a3a-2127-422b-91ae-364da2661108	http://sf.net/p/nsis/bugs/1296	Issue Tracking, Permissions Required
af854a3a-2127-422b-91ae-364da2661108	https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0	Patch
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2024/09/msg00013.html
af854a3a-2127-422b-91ae-364da2661108	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK/
af854a3a-2127-422b-91ae-364da2661108	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM/
af854a3a-2127-422b-91ae-364da2661108	https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/	Release Notes

Impacted products

	Vendor	Product	Version
	nullsoft	nullsoft_scriptable_install_system	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "18F35A89-2710-4212-8C1C-1333A64EBDAA",
              "versionEndIncluding": "3.09",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory."
    }
  ],
  "id": "CVE-2023-37378",
  "lastModified": "2024-11-21T08:11:36.930",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-07-03T20:15:09.620",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Permissions Required"
      ],
      "url": "http://sf.net/p/nsis/bugs/1296"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK/"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes"
      ],
      "url": "https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes"
      ],
      "url": "https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Permissions Required"
      ],
      "url": "http://sf.net/p/nsis/bugs/1296"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00013.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2023-37378 (GCVE-0-2023-37378)

Vulnerability from cvelistv5

icsa-23-222-02

Vulnerability from csaf_cisa

ICSA-23-222-02

Vulnerability from csaf_cisa

ghsa-5r79-3284-v2f8

Vulnerability from github

gsd-2023-37378

Vulnerability from gsd

CERTFR-2023-AVI-0633

Vulnerability from certfr_avis

Solution

fkie_cve-2023-37378

Vulnerability from fkie_nvd

Tags

Sightings

Nomenclature