CVE-2023-32546 Code injection in Chatwork Desktop Application (Mac)
A code injection flaw in Chatwork Desktop for Mac allows non-administrative users to store and obtain audio and image data without consent.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-32546?
CVE-2023-32546 is a medium-severity code injection vulnerability in Chatwork Desktop Application (Mac), published on 13 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Code injection vulnerability exists in Chatwork Desktop Application (Mac) 2.6.43 and earlier. If this vulnerability is exploited, a non-administrative user of the Mac where the product is installed may store and obtain audio and image data from the product without the user's consent.
Weakness: CWE-94
Which versions are affected by CVE-2023-32546?
It affects 1 product.
Products include Chatwork Chatwork.
How do I fix CVE-2023-32546?
No fix has been published for CVE-2023-32546 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-32546 being exploited?
There is no known exploitation of CVE-2023-32546 in the wild and no public exploit code.
Other vulnerabilities in Chatwork Desktop Application (Mac)
Sources
Also known as GHSA-9f59-c2r5-558x.