1E-2023-2004

Improper neutralization of special elements in 1E platform

Bulletin ID
1E-2023-2004
Issue Date
13. 10. 2023
Last Update
19. 10. 2023
Priority
Critical
CVSS
9.9 (Critical)
Assigned CVE
CVE-2023-45162
Affected Products
1E Platform

1. Vulnerability Details

CVE-ID

Description

Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution.

 

Application of the relevant hotfix remediates this issue.

 

for v8.1.2 apply hotfix Q23166
for v8.4.1 apply hotfix Q23164
for v9.0.1 apply hotfix Q23173

 

SaaS implementations on v23.7.1 will automatically have hotfix Q23173 applied. Customers with SaaS versions below this are urged to upgrade urgently – please contact 1E to arrange this.

CVSS3.1 Score

Base Score 9.9 (Critical)

CVSS3.1 Vector String

Problem type

2. Affected products and versions

Product Versions

1E Platform

8.1.2

1E Platform

8.4.1

1E Platform

9.0.1

1E Platform

23.7.1