CVE-2023-38334

Omnis Studio 10.22.00 has incorrect access control. It advertises an irreversible feature for locking classes within Omnis libraries: it should be no longer possible to delete, view, change, copy, rename, duplicate, or print a locked class. Due to implementation issues, locked classes in Omnis libraries can be unlocked, and thus further analyzed and modified by Omnis Studio. This allows for further analyzing and also deleting, viewing, changing, copying, renaming, duplicating, or printing previously locked Omnis classes. This violates the expected behavior of an "irreversible operation."

• CWE-276

• http://packetstormsecurity.com/files/173696/Omnis-Studio-10.22.00-Library-Unlock.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2023/Jul/42Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2023/Jul/43Not Applicable
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-006.txtThird Party Advisory
• http://packetstormsecurity.com/files/173696/Omnis-Studio-10.22.00-Library-Unlock.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2023/Jul/42Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2023/Jul/43Not Applicable
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-006.txtThird Party Advisory

Published

Jul 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38329An issue was discovered in eGroupWare 17.1.20190111. A cross…6.1
• CVE-2023-3833A vulnerability was found in Bug Finder Montage 1.0. It has …6.1
• CVE-2023-38330OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 all…5.3
• CVE-2023-38331Zoho ManageEngine Support Center Plus 14001 and below is vul…5.4
• CVE-2023-38332Zoho ManageEngine ADManager Plus through 7201 allow authenti…6.5
• CVE-2023-38333Zoho ManageEngine Applications Manager through 16530 allows …6.1
• CVE-2023-38335Omnis Studio 10.22.00 has incorrect access control. It adver…5.3
• CVE-2023-38336netkit-rcp in rsh-client 0.17-24 allows command injection vi…9.8
• CVE-2023-38337rswag before 2.10.1 allows remote attackers to read arbitrar…7.5
• CVE-2023-3834A vulnerability was found in Bug Finder EX-RATE 1.0. It has …6.1
• CVE-2023-38343An XXE (XML external entity injection) vulnerability exists …7.5
• CVE-2023-38344An issue was discovered in Ivanti Endpoint Manager before 20…6.5