CVE-2023-38334
- State
- Published
- Severity
- Not scored
- Published
- Jul 20, 2023
- Updated
- Oct 24, 2024
- Reserved
- Jul 14, 2023
Description
Omnis Studio 10.22.00 has incorrect access control. It advertises an irreversible feature for locking classes within Omnis libraries: it should be no longer possible to delete, view, change, copy, rename, duplicate, or print a locked class. Due to implementation issues, locked classes in Omnis libraries can be unlocked, and thus further analyzed and modified by Omnis Studio. This allows for further analyzing and also deleting, viewing, changing, copying, renaming, duplicating, or printing previously locked Omnis classes. This violates the expected behavior of an "irreversible operation."
Scores
The record has no CVSS score.
Weaknesses
- CWE-276 Incorrect Default Permissions
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-006.txt
- 20230721 [SYSS-2023-006]: Omnis Studio - Expected Behavior Violation (CWE-440) (CVE-2023-38334)mailing-list
- http://packetstormsecurity.com/files/173696/Omnis-Studio-10.22.00-Library-Unlock.html
- 20230724 APPLE-SA-2023-07-24-1 Safari 16.6mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.