T
AIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario where a user is using the JCICSecurityTool and has completed identity verification, if the user browses a malicious webpage created by an attacker, the attacker can exploit this vulnerability to read or modify any registry file under HKEY_CURRENT_USER, thereby achieving remote code execution.
References
| Link | Resource |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-7602-a47a2-1.html | Third Party Advisory |
| https://www.twcert.org.tw/tw/cp-132-7602-a47a2-1.html | Third Party Advisory |
Configurations
History
21 Nov 2024, 08:31
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.twcert.org.tw/tw/cp-132-7602-a47a2-1.html - Third Party Advisory |
14 Oct 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario where a user is using the JCICSecurityTool and has completed identity verification, if the user browses a malicious webpage created by an attacker, the attacker can exploit this vulnerability to read or modify any registry file under HKEY_CURRENT_USER, thereby achieving remote code execution. | |
| CWE | CWE-940 |
03 Oct 2024, 18:40
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo |
Information
Published : 2023-12-15 09:15
Updated : 2024-11-21 08:31
NVD link : CVE-2023-48387
Mitre link : CVE-2023-48387
CVE.ORG link : CVE-2023-48387
JSON object : View
Products Affected
CWE