Log in Start free

Vulnerability · Published Jul 19, 2023 · Assigned by icscert

CVE-2023-3463GE Digital CIMPLICITY Heap-based Buffer Overflow

Medium 6.6

In plain English

A medium-severity heap buffer overflow in CIMPLICITY from GE Digital. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)0.4%top 67.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

All versions of GE Digital CIMPLICITY that are not adhering to SDG guidance and accepting documents from untrusted sources are vulnerable to memory corruption issues due to insufficient input validation, including issues such as out-of-bounds reads and writes, use-after-free, stack-based buffer overflows, uninitialized pointers, and a heap-based buffer overflow. Successful exploitation could allow an attacker to execute arbitrary code.

Affected products (as reported)

VendorProductVersions
GE Digital CIMPLICITY All

Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

References