CVE-2023-5607 Path traversal in Trellix Application and Change Control (TACC)
An authorized administrator can execute arbitrary code via path traversal in the TACC ePO extension by uploading a malicious GTI reputation file.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-5607?
CVE-2023-5607 is a high-severity path traversal vulnerability in Trellix Application and Change Control (TACC), published on 27 Nov 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior to version 8.4.0 could lead to an authorised administrator attacker executing arbitrary code through uploading a specially crafted GTI reputation file. The attacker would need the appropriate privileges to access the relevant section of the User Interface. The import logic has been updated to restrict file types and content.
Weakness: CWE-22
Which versions are affected by CVE-2023-5607?
It affects 1 product.
Products include Trellix Application and Change Control.
How do I fix CVE-2023-5607?
No fix has been published for CVE-2023-5607 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-5607 being exploited?
There is no known exploitation of CVE-2023-5607 in the wild and no public exploit code.
Sources
Also known as GHSA-vrr9-g953-pjgq.