CVE-2023-49114 - OpenCVE

A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are met.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
http://seclists.org/fulldisclosure/2024/Mar/10
https://r.sec-consult.com/qognify

History

Wed, 14 Aug 2024 16:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: SEC-VLab

Published: 2024-02-26T12:19:44.624Z

Updated: 2024-08-14T14:23:49.692Z

Reserved: 2023-11-22T11:08:37.654Z

Link: CVE-2023-49114

Vulnrichment

Updated: 2024-08-02T21:46:29.209Z

NVD

Status : Awaiting Analysis

Published: 2024-02-26T16:27:47.217

Modified: 2024-08-14T15:35:03.470

Link: CVE-2023-49114

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-49114", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2023-11-22T11:08:37.654Z", "datePublished": "2024-02-26T12:19:44.624Z", "dateUpdated": "2024-08-14T14:23:49.692Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "VMS Client Viewer", "vendor": "Qognify", "versions": [{"status": "affected", "version": ">=7.1"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Sandro Einfeldt (SEC Consult Vulnerability Lab)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are met.</span><br><br>"}], "value": "A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some\u00a0specific pre-conditions are met.\n\n"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2024-02-26T12:19:44.624Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://r.sec-consult.com/qognify"}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/10"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vendor provides an updated hardening guide for their customers which should be implemented to ensure that no DLLs can be preloaded. <span style=\"background-color: var(--wht);\">It can be found in the PartnerWeb portal for customers of Qognify.</span></p>"}], "value": "The vendor provides an updated hardening guide for their customers which should be implemented to ensure that no DLLs can be preloaded.\u00a0It can be found in the PartnerWeb portal for customers of Qognify.\n\n"}], "source": {"discovery": "EXTERNAL"}, "title": "Local Privilege Escalation via DLL Hijacking", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:46:29.209Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://r.sec-consult.com/qognify"}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/10", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "qognify", "product": "vms_client_viewer", "cpes": ["cpe:2.3:a:qognify:vms_client_viewer:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.1", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-14T14:20:29.383621Z", "id": "CVE-2023-49114", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-14T14:23:49.692Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://r.sec-consult.com/qognify", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/10", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:46:29.209Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-49114", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-14T14:20:29.383621Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:qognify:vms_client_viewer:*:*:*:*:*:*:*:*"], "vendor": "qognify", "product": "vms_client_viewer", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "7.1"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-14T14:23:42.695Z"}}], "cna": {"title": "Local Privilege Escalation via DLL Hijacking", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Sandro Einfeldt (SEC Consult Vulnerability Lab)"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"vendor": "Qognify", "product": "VMS Client Viewer", "versions": [{"status": "affected", "version": ">=7.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The vendor provides an updated hardening guide for their customers which should be implemented to ensure that no DLLs can be preloaded.\u00a0It can be found in the PartnerWeb portal for customers of Qognify.\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>The vendor provides an updated hardening guide for their customers which should be implemented to ensure that no DLLs can be preloaded. <span style=\"background-color: var(--wht);\">It can be found in the PartnerWeb portal for customers of Qognify.</span></p>", "base64": false}]}], "references": [{"url": "https://r.sec-consult.com/qognify", "tags": ["third-party-advisory"]}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/10"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some\u00a0specific pre-conditions are met.\n\n", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are met.</span><br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2024-02-26T12:19:44.624Z"}}}, "cveMetadata": {"cveId": "CVE-2023-49114", "state": "PUBLISHED", "dateUpdated": "2024-08-14T14:23:49.692Z", "dateReserved": "2023-11-22T11:08:37.654Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2024-02-26T12:19:44.624Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.1"}