CVE-2023-30795 (GCVE-0-2023-30795)
Vulnerability from cvelistv5 – Published: 2023-08-08 09:20 – Updated: 2024-10-11 22:16
VLAI?
Summary
A vulnerability has been identified in JT Open (All versions < V11.4), JT Utilities (All versions < V13.4), Parasolid V34.0 (All versions < V34.0.253), Parasolid V34.1 (All versions < V34.1.243), Parasolid V35.0 (All versions < V35.0.177), Parasolid V35.1 (All versions < V35.1.073). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.
Severity ?
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Siemens | JT Open |
Affected:
All versions < V11.4
|
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:37:15.439Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-001569.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-30795",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-11T22:16:06.900938Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-11T22:16:31.109Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "JT Open",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V11.4"
}
]
},
{
"defaultStatus": "unknown",
"product": "JT Utilities",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V13.4"
}
]
},
{
"defaultStatus": "unknown",
"product": "Parasolid V34.0",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V34.0.253"
}
]
},
{
"defaultStatus": "unknown",
"product": "Parasolid V34.1",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V34.1.243"
}
]
},
{
"defaultStatus": "unknown",
"product": "Parasolid V35.0",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V35.0.177"
}
]
},
{
"defaultStatus": "unknown",
"product": "Parasolid V35.1",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V35.1.073"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in JT Open (All versions \u003c V11.4), JT Utilities (All versions \u003c V13.4), Parasolid V34.0 (All versions \u003c V34.0.253), Parasolid V34.1 (All versions \u003c V34.1.243), Parasolid V35.0 (All versions \u003c V35.0.177), Parasolid V35.1 (All versions \u003c V35.1.073). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-08T09:20:19.964Z",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-001569.pdf"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2023-30795",
"datePublished": "2023-08-08T09:20:19.964Z",
"dateReserved": "2023-04-18T09:19:57.943Z",
"dateUpdated": "2024-10-11T22:16:31.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:jt_open:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"11.4\", \"matchCriteriaId\": \"0C5E38E9-C07C-4E2C-A2A5-B3A0E77B5B00\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:jt_utilities:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"13.4\", \"matchCriteriaId\": \"C1B0B2A2-1A1A-4B0F-B957-2D5B6EBDB0FE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"34.0\", \"versionEndExcluding\": \"34.0.253\", \"matchCriteriaId\": \"0856DA04-7E50-4EF7-AB5A-D09349B188B0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"34.1\", \"versionEndExcluding\": \"34.1.243\", \"matchCriteriaId\": \"2785D65C-6EA7-4602-9A81-6E54F45E9F43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"35.0\", \"versionEndExcluding\": \"35.0.177\", \"matchCriteriaId\": \"884A8645-3BB6-4AF6-9B3A-1C73E9F8344B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"35.1\", \"versionEndExcluding\": \"35.1.073\", \"matchCriteriaId\": \"C3FD284B-0089-4430-89F0-41B93D61C717\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability has been identified in JT Open (All versions \u003c V11.4), JT Utilities (All versions \u003c V13.4), Parasolid V34.0 (All versions \u003c V34.0.253), Parasolid V34.1 (All versions \u003c V34.1.243), Parasolid V35.0 (All versions \u003c V35.0.177), Parasolid V35.1 (All versions \u003c V35.1.073). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.\"}, {\"lang\": \"es\", \"value\": \"Se ha identificado una vulnerabilidad en JT Open (Todas las versiones inferiores a V11.4), JT Utilities (Todas las versiones inferiores a V13.4), Parasolid V34.0 (Todas las versiones inferiores a V34.0.253), Parasolid V34.1 (Todas las versiones inferiores a V34.1.243), Parasolid V35.0 (Todas las versiones inferiores a V35.0.177), Parasolid V35.1 (Todas las versiones inferiores a V35.1.073). Las aplicaciones afectadas contienen una lectura fuera de l\\u00edmites m\\u00e1s all\\u00e1 del final de una estructura asignada al analizar archivos JT especialmente dise\\u00f1ados. Esto podr\\u00eda permitir a un atacante ejecutar c\\u00f3digo en el contexto del proceso actual.\"}]",
"id": "CVE-2023-30795",
"lastModified": "2024-11-21T08:00:55.000",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"productcert@siemens.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
"published": "2023-08-08T10:15:15.067",
"references": "[{\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-001569.pdf\", \"source\": \"productcert@siemens.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-001569.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
"sourceIdentifier": "productcert@siemens.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"productcert@siemens.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-125\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-125\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-30795\",\"sourceIdentifier\":\"productcert@siemens.com\",\"published\":\"2023-08-08T10:15:15.067\",\"lastModified\":\"2024-11-21T08:00:55.000\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in JT Open (All versions \u003c V11.4), JT Utilities (All versions \u003c V13.4), Parasolid V34.0 (All versions \u003c V34.0.253), Parasolid V34.1 (All versions \u003c V34.1.243), Parasolid V35.0 (All versions \u003c V35.0.177), Parasolid V35.1 (All versions \u003c V35.1.073). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad en JT Open (Todas las versiones inferiores a V11.4), JT Utilities (Todas las versiones inferiores a V13.4), Parasolid V34.0 (Todas las versiones inferiores a V34.0.253), Parasolid V34.1 (Todas las versiones inferiores a V34.1.243), Parasolid V35.0 (Todas las versiones inferiores a V35.0.177), Parasolid V35.1 (Todas las versiones inferiores a V35.1.073). Las aplicaciones afectadas contienen una lectura fuera de l\u00edmites m\u00e1s all\u00e1 del final de una estructura asignada al analizar archivos JT especialmente dise\u00f1ados. Esto podr\u00eda permitir a un atacante ejecutar c\u00f3digo en el contexto del proceso actual.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"productcert@siemens.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"productcert@siemens.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:jt_open:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"11.4\",\"matchCriteriaId\":\"0C5E38E9-C07C-4E2C-A2A5-B3A0E77B5B00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:jt_utilities:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"13.4\",\"matchCriteriaId\":\"C1B0B2A2-1A1A-4B0F-B957-2D5B6EBDB0FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"34.0\",\"versionEndExcluding\":\"34.0.253\",\"matchCriteriaId\":\"0856DA04-7E50-4EF7-AB5A-D09349B188B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"34.1\",\"versionEndExcluding\":\"34.1.243\",\"matchCriteriaId\":\"2785D65C-6EA7-4602-9A81-6E54F45E9F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"35.0\",\"versionEndExcluding\":\"35.0.177\",\"matchCriteriaId\":\"884A8645-3BB6-4AF6-9B3A-1C73E9F8344B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"35.1\",\"versionEndExcluding\":\"35.1.073\",\"matchCriteriaId\":\"C3FD284B-0089-4430-89F0-41B93D61C717\"}]}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-001569.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-001569.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-001569.pdf\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T14:37:15.439Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-30795\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-11T22:16:06.900938Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-11T22:16:26.670Z\"}}], \"cna\": {\"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\"}}], \"affected\": [{\"vendor\": \"Siemens\", \"product\": \"JT Open\", \"versions\": [{\"status\": \"affected\", \"version\": \"All versions \u003c V11.4\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"JT Utilities\", \"versions\": [{\"status\": \"affected\", \"version\": \"All versions \u003c V13.4\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Parasolid V34.0\", \"versions\": [{\"status\": \"affected\", \"version\": \"All versions \u003c V34.0.253\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Parasolid V34.1\", \"versions\": [{\"status\": \"affected\", \"version\": \"All versions \u003c V34.1.243\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Parasolid V35.0\", \"versions\": [{\"status\": \"affected\", \"version\": \"All versions \u003c V35.0.177\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Parasolid V35.1\", \"versions\": [{\"status\": \"affected\", \"version\": \"All versions \u003c V35.1.073\"}], \"defaultStatus\": \"unknown\"}], \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-001569.pdf\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability has been identified in JT Open (All versions \u003c V11.4), JT Utilities (All versions \u003c V13.4), Parasolid V34.0 (All versions \u003c V34.0.253), Parasolid V34.1 (All versions \u003c V34.1.243), Parasolid V35.0 (All versions \u003c V35.0.177), Parasolid V35.1 (All versions \u003c V35.1.073). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125: Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"cec7a2ec-15b4-4faf-bd53-b40f371f3a77\", \"shortName\": \"siemens\", \"dateUpdated\": \"2023-08-08T09:20:19.964Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-30795\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-11T22:16:31.109Z\", \"dateReserved\": \"2023-04-18T09:19:57.943Z\", \"assignerOrgId\": \"cec7a2ec-15b4-4faf-bd53-b40f371f3a77\", \"datePublished\": \"2023-08-08T09:20:19.964Z\", \"assignerShortName\": \"siemens\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…