CVE-2023-50440

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before 2023.5; ZEDMAIL for Windows before 2023.5; ZED! for Windows, Mac, Linux before 2023.5; ZEDFREE for Windows, Mac, Linux before 2023.5; or ZEDPRO for Windows, Mac, Linux before 2023.5 can be modified by an unauthenticated attacker to include a UNC reference so that it could trigger network access to an attacker-controlled computer when opened by the victim.

Contenedores ZED producidos por PRIMX ZED! para Windows anteriores a Q.2020.3 (presentación de calificación ANSSI); ZED! para Windows anteriores a Q.2021.2 (presentación de calificación ANSSI); ZONECENTRAL para Windows antes de Q.2021.2 (presentación de calificación ANSSI); ZONECENTRAL para Windows antes de 2023.5; ZEDMAIL para Windows antes de 2023.5; ZED! para Windows, Mac, Linux antes de 2023.5; ZEDFREE para Windows, Mac, Linux antes de 2023.5; o ZEDPRO para Windows, Mac, Linux anterior a 2023.5 puede ser modificado por un atacante no autenticado para incluir una referencia UNC de modo que pueda activar el acceso a la red a una maquina controlada por el atacante cuando la víctima la abra.

*Credits: N/A

CVSS Scores

NISTv3.1 5.5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-12-10 CVE Reserved
2023-12-13 CVE Published
2023-12-21 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (2)

URL	Tag	Source
https://www.primx.eu/fr/blog	Product

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.primx.eu/en/bulletins/security-bulletin-23B30931	2023-12-20

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Primx Search vendor "Primx"		Zed\! Search vendor "Primx" for product "Zed\!"				< 2023.5 Search vendor "Primx" for product "Zed\!" and version " < 2023.5"		enterprise, linux		Affected
Primx Search vendor "Primx"		Zed\! Search vendor "Primx" for product "Zed\!"				< 2023.5 Search vendor "Primx" for product "Zed\!" and version " < 2023.5"		enterprise, macos		Affected
Primx Search vendor "Primx"		Zed\! Search vendor "Primx" for product "Zed\!"				< 2023.5 Search vendor "Primx" for product "Zed\!" and version " < 2023.5"		free, linux		Affected
Primx Search vendor "Primx"		Zed\! Search vendor "Primx" for product "Zed\!"				< 2023.5 Search vendor "Primx" for product "Zed\!" and version " < 2023.5"		free, macos		Affected
Primx Search vendor "Primx"		Zed\! Search vendor "Primx" for product "Zed\!"				< 2023.5 Search vendor "Primx" for product "Zed\!" and version " < 2023.5"		free, windows		Affected
Primx Search vendor "Primx"		Zed\! Search vendor "Primx" for product "Zed\!"				< 2023.5 Search vendor "Primx" for product "Zed\!" and version " < 2023.5"		pro, linux		Affected
Primx Search vendor "Primx"		Zed\! Search vendor "Primx" for product "Zed\!"				< 2023.5 Search vendor "Primx" for product "Zed\!" and version " < 2023.5"		pro, macos		Affected
Primx Search vendor "Primx"		Zed\! Search vendor "Primx" for product "Zed\!"				< 2023.5 Search vendor "Primx" for product "Zed\!" and version " < 2023.5"		pro, windows		Affected
Primx Search vendor "Primx"		Zed\! Search vendor "Primx" for product "Zed\!"				< q.2020.3 Search vendor "Primx" for product "Zed\!" and version " < q.2020.3"		enterprise, windows		Affected
Primx Search vendor "Primx"		Zed\! Search vendor "Primx" for product "Zed\!"				>= 2023.0 < 2023.5 Search vendor "Primx" for product "Zed\!" and version " >= 2023.0 < 2023.5"		enterprise, windows		Affected
Primx Search vendor "Primx"		Zed\! Search vendor "Primx" for product "Zed\!"				>= q.2021.0 < q.2021.2 Search vendor "Primx" for product "Zed\!" and version " >= q.2021.0 < q.2021.2"		enterprise, windows		Affected
Primx Search vendor "Primx"		Zedmail Search vendor "Primx" for product "Zedmail"				< 2023.5 Search vendor "Primx" for product "Zedmail" and version " < 2023.5"		windows		Affected
Primx Search vendor "Primx"		Zonecentral Search vendor "Primx" for product "Zonecentral"				< q.2021.2 Search vendor "Primx" for product "Zonecentral" and version " < q.2021.2"		windows		Affected
Primx Search vendor "Primx"		Zonecentral Search vendor "Primx" for product "Zonecentral"				>= 2023.0 < 2023.5 Search vendor "Primx" for product "Zonecentral" and version " >= 2023.0 < 2023.5"		windows		Affected