CVE-2023-45162

moderate-risk

Published 2023-10-13

Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Application of the relevant hotfix remediates this issue. for v8.1.2 apply hotfix Q23166 for v8.4.1 apply hotfix Q23164 for v9.0.1 apply hotfix Q23169 SaaS implementations on v23.7.1 will automatically have hotfix Q23173 applied. Customers with SaaS versions below this are urged to upgrade urgently - please contact 1E to arrange this

Do I need to act?

0.09% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.9/10 Critical

NETWORK / LOW complexity

Affected Products (4)

Platform

Affected Vendors

References (2)

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/1e-2023-...

Vendor Advisory https://www.1e.com/trust-security-compliance/cve-info/

/ 100

moderate-risk

Severity 33/34 · Critical

Exploitability 0/34 · Minimal

Exposure 10/34 · Low