8.8
High
CVE-2023-27982 A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause…
Description
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause manipulation of dashboard files in the IGSS project report directory, when an attacker sends specific crafted messages to the Data Server TCP port, this could lead to remote code execution when a victim eventually opens a malicious dashboard file. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| IGSS Data Server(IGSSdataServer.exe) 16.0 | earliest → 16.0.0.23040 | No fix stated |
| IGSS Dashboard (DashBoard.exe) 16.0 | earliest → 16.0.0.23040 | No fix stated |
| Custom Reports (RMS16.dll) 16.0 | earliest → 16.0.0.23040 | No fix stated |
Other CVEs of IGSS Data Server(IGSSdataServer.exe)
The 8 CVEs of IGSS Data Server(IGSSdataServer.exe) →
CVE-2023-27977
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause…
6.5
Medium
CVE-2023-27978
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an…
7.8
High
CVE-2023-27979
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the…
6.5
Medium
CVE-2023-27980
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could…
8.8
High