CVE-2023-0093

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-0093", "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a", "assignerShortName": "Okta", "dateUpdated": "2025-03-06T19:42:29.370Z", "dateReserved": "2023-01-05T00:00:00.000Z", "datePublished": "2023-03-06T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a", "shortName": "Okta", "dateUpdated": "2023-03-06T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment."}], "affected": [{"vendor": "Okta", "product": "Advanced Server Access", "versions": [{"version": "1.13.1 through 1.65.0", "status": "affected"}]}], "references": [{"url": "https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Command Injection"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:02:43.461Z"}, "title": "CVE Program Container", "references": [{"url": "https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-03-06T19:39:33.009371Z", "id": "CVE-2023-0093", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-06T19:42:29.370Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:02:43.461Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-0093", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-06T19:39:33.009371Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-06T19:39:27.771Z"}}], "cna": {"affected": [{"vendor": "Okta", "product": "Advanced Server Access", "versions": [{"status": "affected", "version": "1.13.1 through 1.65.0"}]}], "references": [{"url": "https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093/"}], "descriptions": [{"lang": "en", "value": "Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Command Injection"}]}], "providerMetadata": {"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a", "shortName": "Okta", "dateUpdated": "2023-03-06T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2023-0093", "state": "PUBLISHED", "dateUpdated": "2025-03-06T19:42:29.370Z", "dateReserved": "2023-01-05T00:00:00.000Z", "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a", "datePublished": "2023-03-06T00:00:00.000Z", "assignerShortName": "Okta"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Advanced Server Access", "vendor": "Okta", "versions": [{"status": "affected", "version": "1.13.1 through 1.65.0"}]}], "source": "psirt@okta.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:okta:advanced_server_access:*:*:*:*:*:*:*:*", "matchCriteriaId": "8246431D-FAFE-428E-BBC0-8AEBDEE2F1D8", "versionEndExcluding": "1.68.2", "versionStartIncluding": "1.13.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment."}], "id": "CVE-2023-0093", "lastModified": "2026-06-17T05:24:45.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-0093", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-03-06T19:39:33.009371Z", "version": "2.0.3"}}]}, "published": "2023-03-06T21:15:10.933", "references": [{"source": "psirt@okta.com", "tags": ["Vendor Advisory"], "url": "https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093/"}], "sourceIdentifier": "psirt@okta.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-77"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}