Vulnerability · Published Mar 6, 2023 · Assigned by Okta
CVE-2023-0093
High 8.8
In plain English
A high-severity command injection in Advanced Server Access from Okta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Official description
Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Okta | Advanced Server Access | 1.13.1 through 1.65.0 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H