Qumu Multicast Extension up to 2.0.62 on Windows Pop-Up Window permission

Summaryinfo

A vulnerability categorized as critical has been discovered in Qumu Multicast Extension up to 2.0.62 on Windows. Affected by this issue is some unknown functionality of the component Pop-Up Window Handler. Such manipulation leads to permission. This vulnerability is documented as CVE-2023-45883. The attack needs to be performed locally. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Qumu Multicast Extension up to 2.0.62 on Windows. It has been rated as critical. Affected by this issue is an unknown functionality of the component Pop-Up Window Handler. The manipulation with an unknown input leads to a permission vulnerability. Using CWE to declare the problem leads to CWE-275. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A privilege escalation vulnerability exists within the Qumu Multicast Extension v2 before 2.0.63 for Windows. When a standard user triggers a repair of the software, a pop-up window opens with SYSTEM privileges. Standard users may use this to gain arbitrary code execution as SYSTEM.

The weakness was released 10/19/2023. The advisory is shared for download at hackandpwn.com. This vulnerability is handled as CVE-2023-45883 since 10/15/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1222.

Upgrading to version 2.0.63 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-50148). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Qumu Multicast Extension

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14
• 2.0.15
• 2.0.16
• 2.0.17
• 2.0.18
• 2.0.19
• 2.0.20
• 2.0.21
• 2.0.22
• 2.0.23
• 2.0.24
• 2.0.25
• 2.0.26
• 2.0.27
• 2.0.28
• 2.0.29
• 2.0.30
• 2.0.31
• 2.0.32
• 2.0.33
• 2.0.34
• 2.0.35
• 2.0.36
• 2.0.37
• 2.0.38
• 2.0.39
• 2.0.40
• 2.0.41
• 2.0.42
• 2.0.43
• 2.0.44
• 2.0.45
• 2.0.46
• 2.0.47
• 2.0.48
• 2.0.49
• 2.0.50
• 2.0.51
• 2.0.52
• 2.0.53
• 2.0.54
• 2.0.55
• 2.0.56
• 2.0.57
• 2.0.58
• 2.0.59
• 2.0.60
• 2.0.61
• 2.0.62

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion