CVE-2023-49329

Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This arises from improper handling of untrusted input, enabling an attacker to elevate privileges, execute system commands, and potentially compromise the underlying operating system. The fixed versions are 4.4.5, 4.5.4, and 4.6.2. The earliest affected version is 4.3.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.anomali.com/collaborate/ciso-blog	Product
https://www.anomali.com/security-advisory/anml-2023-01	Mitigation Vendor Advisory
https://www.anomali.com/collaborate/ciso-blog	Product
https://www.anomali.com/security-advisory/anml-2023-01	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:anomali:match::::::::
	cpe:2.3:a:anomali:match::::::::
	cpe:2.3:a:anomali:match::::::::

History

21 Nov 2024, 08:33

Type	Values Removed	Values Added
References	~~() https://www.anomali.com/collaborate/ciso-blog - Product~~	() https://www.anomali.com/collaborate/ciso-blog - Product
References	~~() https://www.anomali.com/security-advisory/anml-2023-01 - Mitigation, Vendor Advisory~~	() https://www.anomali.com/security-advisory/anml-2023-01 - Mitigation, Vendor Advisory

26 Jan 2024, 19:01

Type	Values Removed	Values Added
References	~~() https://www.anomali.com/security-advisory/anml-2023-01 -~~	() https://www.anomali.com/security-advisory/anml-2023-01 - Mitigation, Vendor Advisory
References	~~() https://www.anomali.com/collaborate/ciso-blog -~~	() https://www.anomali.com/collaborate/ciso-blog - Product
CWE		CWE-78
First Time		Anomali Anomali match
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.2
CPE		cpe:2.3:a:anomali:match::::::::

19 Jan 2024, 22:52

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-19 21:15

Updated : 2024-11-21 08:33

NVD link : CVE-2023-49329

Mitre link : CVE-2023-49329

CVE.ORG link : CVE-2023-49329

JSON object : View

Products Affected

anomali

match

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2023-49329", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2024-01-19T21:15:08.320", "references": [{"url": "https://www.anomali.com/collaborate/ciso-blog", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.anomali.com/security-advisory/anml-2023-01", "tags": ["Mitigation", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.anomali.com/collaborate/ciso-blog", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.anomali.com/security-advisory/anml-2023-01", "tags": ["Mitigation", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This arises from improper handling of untrusted input, enabling an attacker to elevate privileges, execute system commands, and potentially compromise the underlying operating system. The fixed versions are 4.4.5, 4.5.4, and 4.6.2. The earliest affected version is 4.3."}, {"lang": "es", "value": "Anomali Match anterior a 4.6.2 permite la inyecci\u00f3n de comandos del sistema operativo. Un usuario administrador autenticado puede inyectar y ejecutar comandos del sistema operativo. Esto surge del manejo inadecuado de entradas que no son de confianza, lo que permite a un atacante elevar privilegios, ejecutar comandos del sistema y potencialmente comprometer el sistema operativo subyacente. Las versiones fijas son 4.4.5, 4.5.4 y 4.6.2. La primera versi\u00f3n afectada es la 4.3."}], "lastModified": "2024-11-21T08:33:14.527", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:anomali:match:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D724A998-B623-4BA3-ACA4-D3DAE7AC5483", "versionEndExcluding": "4.4.5", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:a:anomali:match:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47A5D64F-FEE5-4F28-A3D4-CE2F284A40D4", "versionEndExcluding": "4.5.4", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:anomali:match:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DD4E68B-AA7A-4E44-B603-84DD03E325DB", "versionEndExcluding": "4.6.2", "versionStartIncluding": "4.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}