CVE-2023-2993

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-281

Affected software

No affected versions have been published.

Timeline

Published: Jun 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-299308.8An issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execute arbitrary code via CVE-2023-299319.8laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php.CVE-2023-299325.5llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component mlir::IROperand<mlir::OpOperand.CVE-2023-299335.5llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument.CVE-2023-299345.5llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect().CVE-2023-299355.5llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.CVE-2023-299395.5llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::spirv::TargetEnv::TargetEnv(mlir::spirv:CVE-2023-299415.5llvm-project commit a0138390 was discovered to contain a segmentation fault via the component matchAndRewriteSortOp<mlir::sparse_tensor::Sor CVE-2023-299425.5llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::Type::isa<mlir::LLVM::LLVMVoidType.CVE-2023-299449.8Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom CVE-2023-29954.8The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as a CVE-2023-299505.5swfrender v0.9.2 was discovered to contain a heap buffer overflow in the function enumerateUsedIDs_fillstyle at modules/swftools.c