CVE-2023-39532

CVSS 3.1 Score 9.8 of 10 (high)

Details

Published Aug 8, 2023
Updated: Aug 15, 2023
CWE ID 20

Summary

CVE-2023-39532 is a vulnerability that affects the SES (Secure EcmaScript) JavaScript environment. Versions 0.18.0 to 0.18.7, 0.17.0 to 0.17.1, 0.16.0 to 0.16.1, 0.15.0 to 0.15.24, 0.14.0 to 0.14.5, and 0.13.0 to 0.13.5 are susceptible to this vulnerability, which allows a guest program running in a Compartment with no endowments to access the host's dynamic import using the spread operator and dynamic import syntax ({...import(arbitraryModuleSpecifier)}). The impact of this vulnerability depends on the configuration and implementation of the host, but it could potentially lead to information exfiltration or execution of arbitrary code by an attacker with limited access privileges within the affected products (such as sW38PU, sW38PV, etc.). Implementing a Content-Security-Policy following best practices can mitigate the risk associated with this vulnerability by limiting the modules that an attacker can import to those already part of the application. Note: This summary is based on factual information provided in relation to CVE-2023-39532 and does not include any personal opinions or bias

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-39532 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options