Critical – 9.4
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

PT-2023-07: Deserialization of Untrusted Data leads to RCE in Orchid Platform

Error type:

  • CWE-502:Deserialization of Untrusted Data

Vulnerability vector:

  • Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
  • Severity (CVSSv3.1): 9.6 (critical)
  • Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
  • Severity (CVSSv4.0): 9.4 (critical)

Description:

The vulnerability was identified in Orchid Platform versions 14.0.0-alpha4-14.4.0.

The discovered vulnerability of untrusted data deserialization may be exploited by an attacker to remotely execute malicious code.

Vulnerability status: Confirmed by vendor

Date of vulnerability remediation: 05.07.2023

Recommendations:

  • Update to version 14.5.0 or higher

Additional information: 

Additional information: Vladislav Gladkiy (Positive Technologies)

Identifiers:

CVE-2023-36825

BDU:2023-03893

Vendor:

Orchid Software

Vulnerable product:

Orchid Platform

Vulnerable versions:

14.0.0-alpha4-14.4.0