CVE-2023-38335
- State
- Published
- Severity
- Not scored
- Published
- Jul 20, 2023
- Updated
- Oct 24, 2024
- Reserved
- Jul 14, 2023
Description
Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries "always private" - this is supposed to be an irreversible operation. However, due to implementation issues, "always private" Omnis libraries can be opened by the Omnis Studio browser by bypassing specific checks. This violates the expected behavior of an "irreversible operation".
Scores
The record has no CVSS score.
Weaknesses
- CWE-276 Incorrect Default Permissions
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-005.txt
- 20230721 [SYSS-2023-005]: Omnis Studio - Expected Behavior Violation (CWE-440) (CVE-2023-38335)mailing-list
- http://packetstormsecurity.com/files/173695/Omnis-Studio-10.22.00-Library-Setting-Bypass.html
- 20230724 APPLE-SA-2023-07-24-1 Safari 16.6mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.