Vulnerability · Published Mar 29, 2023 · Assigned by rapid7
CVE-2023-28508Heap corruption in UniRPC service
High 8.8
In plain English
A high-severity buffer overflow in UniData from Rocket Software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)0.9%top 40.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a heap-based overflow vulnerability, where certain input can corrupt the heap and crash the forked process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rocket Software | UniData | 0 – before 8.2.43.3003 |
| Rocket Software | UniVerse | 0 – before 11.3.5.10010 – before 12.2.1.2002 |
Weakness: CWE-120