High severity · published Sep 26, 2023
CVE-2023-5183
Authenticated RCE due to unsafe JSON deserialization
8.8
CVSS
1.8%
EPSS
No
On KEV
Description
Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to exploit this vulnerability. The flaw exists within the network_traffic API endpoint. An attacker can leverage this vulnerability to execute code in the context of the PCE’s operating system user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Core PCE · Illumio
19.3.0 through 19.3.6; 21.2.0 through 21.2.7; 21.5.0 through 21.5.35; 22.2.0 through 22.2.41; 22.5.0 through 22.5.30; 23.2.0 through 23.2.10 · source: vendor
CP
Core Policy Compute Engine · Illumio
before 19.3.7; 21.2.0 before 21.2.8; 21.5.0 before 21.5.36; 22.2.0 before 22.2.42; 22.5.0 before 22.5.31; 23.2.0 before 23.2.11 · source: NVD, CISA