CVE-2023-0093

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Mar 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-00945.4The UpQode Google Maps WordPress plugin through 1.0.5 does not validate and escape some of its shortcode attributes before outputting them b CVE-2023-00955.4The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a pa CVE-2023-00965.4The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/p CVE-2023-00975.4The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options be CVE-2023-00988.8The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions CVE-2023-00996.1The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in some pages, leading CVE-2023-01008.8In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HT CVE-2023-01018.8A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated att CVE-2023-01029.1LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker t CVE-2023-01037.5If an attacker were to access memory locations of LS ELECTRIC XBC-DN32U with operating system version 01.80 that are outside of the communic CVE-2023-01047.8The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may CVE-2023-01056.5A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An