CVE-2023-50159 Security feature bypass in n/a
Attackers can bypass Kiosk mode restrictions in ScaleFusion to execute arbitrary code, requiring an upgrade to the latest agent version.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-50159?
CVE-2023-50159 is a high-severity vulnerability in n/a, published on 11 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In ScaleFusion (Windows Desktop App) agent 10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be executed. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode.
Weakness: CWE-284
Which versions are affected by CVE-2023-50159?
It affects 1 product.
Products include Scalefusion Scalefusion.
How do I fix CVE-2023-50159?
No fix has been published for CVE-2023-50159 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-50159 being exploited?
There is no known exploitation of CVE-2023-50159 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5g6p-48pg-5m6f.