CVE-2023-3463: GE Digital CIMPLICITY Heap-based Buffer Overflow
All versions of GE Digital CIMPLICITY that are not adhering to SDG guidance and accepting documents from untrusted sources are vulnerable to memory corruption issues due to insufficient input validation, including issues such as out-of-bounds reads and writes, use-after-free, stack-based buffer overflows, uninitialized pointers, and a heap-based buffer overflow. Successful exploitation could allow an attacker to execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Follow the Secure Deployment Guide (SDG) for GE Digital CIMPLICITY, specifically ensuring the system is configured to not accept/open documents from untrusted sources and maintaining strong access management (exploitation requires an authenticated local user who obtains and opens a malicious document).
Event History
Frequently Asked Questions
What is CVE-2023-3463?
CVE-2023-3463 is a vulnerability found in all versions of GE Digital CIMPLICITY that are not adhering to SDG guidance and accepting documents from untrusted sources.
What is the severity of CVE-2023-3463?
The severity of CVE-2023-3463 is critical with a CVSS score of 9.8.
How does CVE-2023-3463 affect GE CIMPLICITY?
CVE-2023-3463 affects all versions of GE CIMPLICITY that are not adhering to SDG guidance and accepting documents from untrusted sources.
What are the potential issues caused by CVE-2023-3463?
CVE-2023-3463 can lead to memory corruption issues, including out-of-bounds reads and writes, use-after-free, and stack-based buffer overflow.
Is there a fix for CVE-2023-3463?
To fix CVE-2023-3463, it is recommended to follow the SDG guidance and ensure that GE CIMPLICITY does not accept documents from untrusted sources.