CVE-2023-5607
High
Description
An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior to version 8.4.0 could lead to an authorised administrator attacker executing arbitrary code through uploading a specially crafted GTI reputation file. The attacker would need the appropriate privileges to access the relevant section of the User Interface. The import logic has been updated to restrict file types and content.
SeverityHigh
CVSS8.4
Exploit probability—
ProductTrellix Application And Change Control
PublishedNov 27, 2023
First seenNov 27, 2023
Weakness typeCWE-22Path traversal
How to fix
Update
- trellix application_and_change_control8.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| trellix application_and_change_control | v < 8.4.0 | 8.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.