CVE-2023-45849 CRITICAL

CVE-2023-45849: Arbitrary Code Execution in Helix Core

Vendor Helix

Product Helix Core

Weakness CWE-94 · Code injection

Published November 8, 2023

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

9.0/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2. Reported by Jason Geffner.

Key dates

02Disclosure timeline

November 8, 2023 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-45849 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html

Related vulnerabilities

Identifiers

CVE CVE-2023-45849

CWE CWE-94

CVSS 9.0 / CRITICAL

Affected versions

Vendor Helix

Product Helix Core

Affected ≥ 0.0.0 and < 2023.2

Vendor Helix

Product Helix Core

Affected ≥ 0.0.0 and < 2023.1 Patch 2

Vendor Helix

Product Helix Core

Affected ≥ 0.0.0 and < 2022.2 Patch 3

Vendor Helix

Product Helix Core

Affected ≥ 0.0.0 and < 2022.1 Patch 6

Vendor Helix

Product Helix Core

Affected ≥ 0.0.0 and < 2021.2 Patch 10

CVE-2023-45849: Arbitrary Code Execution in Helix Core

01Description

02Disclosure timeline

03References

04Related CVE