CVE-2023-25953
Last modified
CVE-2023-25953 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the affected product is installed to inject arbitrary code while processing the product execution. Since a full disk access privilege is required to execute LINE WORKS Drive Explorer, the attacker may be able to read and/or write to arbitrary files without the access privileges.. EPSS estimates a 0.58% chance of exploitation in the next 30 days.
Description
Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the affected product is installed to inject arbitrary code while processing the product execution. Since a full disk access privilege is required to execute LINE WORKS Drive Explorer, the attacker may be able to read and/or write to arbitrary files without the access privileges.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Worksmobile | Drive Explorer | <= 3.5.4 |
References
- https://jvn.jp/en/jp/JVN01937209/Third Party Advisory
- https://jvn.jp/en/jp/JVN01937209/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-25953?
How severe is CVE-2023-25953?
How do I fix CVE-2023-25953?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-25948Server information leak of configuration data when an error …7.5
- CVE-2023-25949Uncontrolled resource consumption in some Intel(R) Aptio* V …5.5
- CVE-2023-2595A vulnerability has been found in SourceCodester Billing Man…9.8
- CVE-2023-25950HTTP request/response smuggling vulnerability in HAProxy ver…7.3
- CVE-2023-25951Improper input validation for some Intel(R) PROSet/Wireless …6.7
- CVE-2023-25952Out-of-bounds write in some Intel(R) Arc(TM) Control softwar…5.5
- CVE-2023-25954KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA Mo…5.5
- CVE-2023-25955National land numerical information data conversion tool all…5.5
- CVE-2023-25956Generation of Error Message Containing Sensitive Information…7.5
- CVE-2023-25957A vulnerability has been identified in Mendix SAML (Mendix 7…7.5
- CVE-2023-25958Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
- CVE-2023-25959Missing Authorization vulnerability in Apollo13Themes Apollo…5.4
Are you affected by CVE-2023-25953?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST