CVE-2023-5964

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the Caption or Message parameters, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on Windows clients.

To remediate this issue DELETE the instruction “Show dialogue with caption %Caption% and message %Message%” from the list of instructions in the Settings UI, and replace it with the new instruction 1E-Exchange-ShowNotification instruction available in the updated End-User Interaction product pack. The new instruction should show as “Show %Type% type notification with header %Header% and message %Message%” with a version of 7.1 or above.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
1E	Platform	<= 23

References

Timeline

Published: Nov 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-59657.2An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which CVE-2023-59667.2An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployme CVE-2023-59674.3Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to ca CVE-2023-59684.9Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the respo CVE-2023-59695.3Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to CVE-2023-59708.8Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external d CVE-2023-59714.8The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3.2.0 does not sanitise and escape some of its settings, which could allow high p CVE-2023-59727.8A null pointer dereference flaw was found in the nft_inner.c functionality of netfilter in the Linux kernel. This issue could allow a local CVE-2023-59734.3Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName con CVE-2023-59749.8The WPB Show Core WordPress plugin through 2.2 is vulnerable to server-side request forgery (SSRF) via the `path` parameter.CVE-2023-59754.3The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to mis CVE-2023-59764.3Improper Access Control in GitHub repository microweber/microweber prior to 2.0.