CVE-2023-45798

Yettiesoft VestCert Remote Code Execution Vulnerability

High8.4EPSS 0.70%

Published: 30 Oct 2023
Updated: 2 Aug 2024
Reserved: 13 Oct 2023
Assigned by: krcert

Description

In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution.

Scores

CVSS scores of CVE-2023-45798, by who scored it
Scored by	CVSS	Score	Vector
krcertCNA (assigner)	3.1	High8.4	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.70% · top 47% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.4.

Weakness

CWE-829 Inclusion of Functionality from Untrusted Control Sphere (opens in a new tab)All about CWE-829 and its CVEs

Affected products

Yettiesoft · VestCert
- affected 2.3.6 – ≤ 2.5.29

References (1)

https://www.boho.or.kr/kr/bbs/view.do?bbsId=B0000133&nttId=71008&menuNo=205020 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-45798](https://trackcve.app/badge/CVE-2023-45798.svg)](https://trackcve.app/cve/CVE-2023-45798)

Record last updated 2 Aug 2024, 20:29 UTC.