What is CVE-2023-0093?

CVE-2023-0093 is a high-severity vulnerability in Okta Advanced Server Access, classified under Command Injection. CVSS score: 8.8/10. Published 2023-03-06.

How severe is CVE-2023-0093?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Okta Advanced Server Access

CVE-2023-0093

Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.011 (61.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Okta Advanced Server Access — versions 1.13.1 through 1.65.0
Okta Advanced_server_access

Weakness classification (CWE)

CWE-77 — Command Injection

References

psirt@okta.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-0093?: CVE-2023-0093 is a high-severity vulnerability in Okta Advanced Server Access, classified under Command Injection. CVSS score: 8.8/10. Published 2023-03-06.
How severe is CVE-2023-0093?: High severity. CVSS v3 base score is 8.8 out of 10.