CVE-2023-4770

Uncontrolled Search Path Element Vulnerability in 4D and 4D Windows Server

State: Published
Severity: 6.5 Medium
Published: Nov 30, 2023
Updated: Aug 2, 2024
Reserved: Sep 5, 2023

Description

An uncontrolled search path element vulnerability has been found on 4D and 4D server Windows executables applications, affecting version 19 R8 100218. This vulnerability consists in a DLL hijacking by replacing x64 shfolder.dll in the installation path, causing an arbitrary code execution.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H	INCIBE

Weaknesses

CWE-427 Uncontrolled Search Path Element

Affected Products

Product	Versions
4D.exe4D	19 R8 100218Affected
4D Server.exe4D	19 R8 100218Affected

References

https://www.incibe.es/en/incibe-cert/notices/aviso/uncontrolled-search-path-element-vulnerability-4d-and-4d-windows-server

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.