CVE-2023-30262 Deserialization in n/a
Remote unauthenticated attackers can execute arbitrary code via the RMI Registry service in MIM License Server and MIMpacs services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-30262?
CVE-2023-30262 is a high-severity unsafe deserialization vulnerability in n/a, published on 9 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue found in MIM software Inc MIM License Server and MIMpacs services v.6.9 thru v.7.0 fixed in v.7.0.10 allows a remote unauthenticated attacker to execute arbitrary code via the RMI Registry service.
Weakness: CWE-502
Which versions are affected by CVE-2023-30262?
It affects 2 products.
Products include Mimsoftware Mim Concurrent License Server, Mimsoftware Mim Local Concurrent License Server.
How do I fix CVE-2023-30262?
No fix has been published for CVE-2023-30262 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-30262 being exploited?
There is no known exploitation of CVE-2023-30262 in the wild and no public exploit code.
Sources
Also known as GHSA-526p-g2rm-xcqf.