CVE-2023-39532

Summary

CVE-2023-39532 is a vulnerability that affects the SES (Secure EcmaScript) JavaScript environment. Versions 0.18.0 to 0.18.7, 0.17.0 to 0.17.1, 0.16.0 to 0.16.1, 0.15.0 to 0.15.24, 0.14.0 to 0.14.5, and 0.13.0 to 0.13.5 are susceptible to this vulnerability, which allows a guest program running in a Compartment with no endowments to access the host's dynamic import using the spread operator and dynamic import syntax ({...import(arbitraryModuleSpecifier)}). The impact of this vulnerability depends on the configuration and implementation of the host, but it could potentially lead to information exfiltration or execution of arbitrary code by an attacker with limited access privileges within the affected products (such as sW38PU, sW38PV, etc.). Implementing a Content-Security-Policy following best practices can mitigate the risk associated with this vulnerability by limiting the modules that an attacker can import to those already part of the application. Note: This summary is based on factual information provided in relation to CVE-2023-39532 and does not include any personal opinions or bias

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.