CVE-2023-43762

Vulnerability

The vulnerability resides in the web server (backend) component of WithSecure Policy Manager Server and WithSecure Policy Manager Proxy, both version 15. An unauthenticated remote attacker can exploit this flaw to execute arbitrary code on the target system. [2]

Exploitation

An attacker can send specially crafted requests to the vulnerable web server without any authentication. No user interaction is required. The advisory notes that no known exploit has been seen in the wild. [2]

Impact

Successful exploitation allows remote code execution on the client machine, potentially leading to full compromise of the affected system. [2]

Mitigation

WithSecure has released a hotfix (hotfix7) that includes mitigation instructions in the Readme.txt file. Users should apply the hotfix as soon as possible. [2]