Vulnerability · Published Apr 27, 2023 · Assigned by twcert
CVE-2023-20852aEnrich a+HRD - Deserialization of Untrusted Data
Critical 9.8
In plain English
A critical-severity unsafe deserialization in a+HRD from aEnrich. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.0%top 37.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service.
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H