Vulnerability · NVD

CVE-2023-40547

CVE-2023-40547 : high severity (CVSS 8.3). No tracked catalog app is linked to this CVE.

Severity (CVSS): 8.3
Exploitation: 5.4 %
Tracked apps: 0
Still exposed: 0

Published on 2024-01-25

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.

Attack vector : Adjacent network No privileges required No user interaction

Show raw CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS 5.42% above median percentile 92.4%

OS versions that fix this CVE

This CVE is resolved by the following OS security releases. Update the OS to at least the listed version.

Windows Server 2022 (Server Core installation) Fixed in 10.0.20348.3453
Windows Server 2022 Fixed in 10.0.25398.1551
Windows Server 2019 Fixed in 10.0.17763.7136
Windows Server 2016 Fixed in 10.0.14393.7969
Windows 11 24H2 · 2024-H2 Fixed in 10.0.26100.3775
Windows 11 23H2 · 2023-H2 Fixed in 10.0.22631.5189
Windows 11 22H2 · 2022-H2 Fixed in 10.0.22621.5189
Windows 11 21H2 · 2021-H2 Fixed in 10.0.22000.3147
Windows 10 22H2 · 2022-H2 Fixed in 10.0.19045.5737
Windows 10 21H2 · 2021-H2 Fixed in 10.0.19044.5737
Windows 10 1809 · 2018-09 Fixed in 10.0.17763.7136
Windows 10 1607 · 2016-07 Fixed in 10.0.14393.7969

View on NVD ↗ Advisory · access.redhat.com Advisory · bugzilla.redhat.com

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM