Login Request a demo
Critical severity · published Sep 22, 2023
CVE-2023-43762
Certain WithSecure products allow Unauthenticated Remote Code Execution via the web server (backend)
9.8
CVSS
1.4%
EPSS
No
On KEV
Description
Certain WithSecure products allow Unauthenticated Remote Code Execution via the web server (backend). This affects WithSecure Policy Manager 15 and Policy Manager Proxy 15.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FP
F-secure Policy Manager · Withsecure
15.00; 15.00 · source: NVD
PM
Policy Manager Proxy · Withsecure
15.00; 15.00 · source: NVD
Affected product
FP
F-secure Policy Manager
Withsecure
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-43762
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-43762
Vendor Advisory
https://www.withsecure.com/en/support/security-advisories
www.withsecure.com
https://www.withsecure.com/en/support/security-advisories/cve-2023-43762
Broken Link
https://www.withsecure.com/en/support/security-advisories/cve-2023-nnn511
More from F-secure Policy Manager
9.8
CVE-2022-38165
Arbitrary file write in F-Secure Policy Manager through 2022-08-10 allows unauthenticated users to write the file with the contents in arbitrary locations on the F-Secure Policy…
6.1
CVE-2023-43763
Certain WithSecure products allow XSS via an unvalidated parameter in the endpoint
6.1
CVE-2022-38162
Reflected cross-site scripting (XSS) vulnerabilities in WithSecure through 2022-08-10) exists within the F-Secure Policy Manager due to an unvalidated parameter in the endpoint,…