VulnerabilityModified
CVE-2023-5183
Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE.
HIGH 8.8EPSS 1.56%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.56%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to exploit this vulnerability. The flaw exists within the network_traffic API endpoint. An attacker can leverage this vulnerability to execute code in the context of the PCE’s operating system user.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.56% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-502
- Affected
- illumio/core policy compute engine
- Source
- security@illumio.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.