CVE-2023-5964 1E-Exchange-DisplayMessage instruction allows for arbitrary code execution

Critical 9.9 Published 6 Nov 2023 Updated 12 Jun 2025

Attackers can execute arbitrary code with SYSTEM privileges via crafted input in the 1E Exchange DisplayMessage instruction.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-5964?

CVE-2023-5964 is a critical code injection vulnerability in 1E Platform, published on 6 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the Caption or Message parameters, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on Windows clients.

To remediate this issue DELETE the instruction “Show dialogue with caption %Caption% and message %Message%” from the list of instructions in the Settings UI, and replace it with the new instruction 1E-Exchange-ShowNotification instruction available in the updated End-User Interaction product pack. The new instruction should show as “Show %Type% type notification with header %Header% and message %Message%” with a version of 7.1 or above.

Weakness: CWE-20

Which versions are affected by CVE-2023-5964?

It affects 1 product.

Products include 1e Platform.

How do I fix CVE-2023-5964?

No fix has been published for CVE-2023-5964 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-5964 being exploited?

There is no known exploitation of CVE-2023-5964 in the wild and no public exploit code.

Sources

Also known as GHSA-v92h-jfmf-wx2h.