Vulnerability · Published Mar 3, 2023 · Assigned by VulDB

CVE-2023-1164KylinSoft kylin-activation File Import improper authorization

High 8.4

In plain English

A high-severity security flaw in kylin-activation from KylinSoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.4%top 67.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in KylinSoft kylin-activation on KylinOS and classified as critical. Affected by this issue is some unknown functionality of the component File Import. The manipulation leads to improper authorization. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.11-23 and 1.30.10-5.p23 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222260.

Affected products (as reported)

Vendor	Product	Versions
KylinSoft	kylin-activation	n/a

Weakness: CWE-285 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://vuldb.com/?id.222260 vdb-entry, technical-description
https://vuldb.com/?ctiid.222260 signature, permissions-required
https://github.com/i900008/vulndb/blob/main/kylin-activation_vuln.md broken-link, exploit