CVE-2023-4770: Uncontrolled Search Path Element Vulnerability in 4D and 4D Windows Server

Published Nov 30, 2023

Updated

An uncontrolled search path element vulnerability has been found on 4D and 4D server Windows executables applications, affecting version 19 R8 100218. This vulnerability consists in a DLL hijacking by replacing x64 shfolder.dll in the installation path, causing an arbitrary code execution.

Affected Software

3 affected components

All of the following

Any of the following

4d 4D=19-r8

4d Server=19-r8

Microsoft Windows

Event History

Nov 30, 2023

CVE Published

01:32 PM

Data Sourced

01:32 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2023-4770?

CVE-2023-4770 is an uncontrolled search path element vulnerability found in 4D and 4D Server Windows executables.

What is the severity of CVE-2023-4770?

The severity of CVE-2023-4770 is high with a CVSS score of 7.8.

How does CVE-2023-4770 affect 4D and 4D Server?

CVE-2023-4770 affects 4D and 4D Server executables by allowing DLL hijacking, which can lead to arbitrary code execution.

Which version of 4D and 4D Server is affected by CVE-2023-4770?

Version 19 R8 100218 of 4D and 4D Server is affected by CVE-2023-4770.

Is Microsoft Windows affected by CVE-2023-4770?

No, Microsoft Windows is not vulnerable to CVE-2023-4770.

How can I fix CVE-2023-4770?

To fix CVE-2023-4770, update to a version of 4D and 4D Server that is not affected by this vulnerability.

Where can I find more information about CVE-2023-4770?

You can find more information about CVE-2023-4770 at the following reference: [link](https://www.incibe.es/en/incibe-cert/notices/aviso/uncontrolled-search-path-element-vulnerability-4d-and-4d-windows-server)