CVE-2023-20852
aEnrich a+HRD - Deserialization of Untrusted Data
Published Apr 27, 2023
CVSS 3.1 · 9.8 Critical
EPSS < 1%
KEV · Not listed
Description
aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service.
Analysis
Affected Products
-
CVE record
-
NVD configurations
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| aEnrich | a+HRD | affected |
|
No data.
No data available yet.
Remediation
Vendor Solution
Update a+HRD version to eHRD6.8.1039V920 and later
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-25031 | aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service. |
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.986% probability within 30 days)
Exploitation none
Automatable yes
Technical Impact total
References
| Link | Providers |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-7023-8368b-1.html |
|
History
Jan 30, 2025 10:15 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Weaknesses
-
CWE-502
Deserialization of Untrusted Data
