What is CVE-2023-3314?

CVE-2023-3314 is a high-severity vulnerability in Trellix Enterprise Security Manager, classified under OS Command Injection. CVSS score: 8.1/10. Published 2023-07-03.

How severe is CVE-2023-3314?

High severity. CVSS v3 base score is 8.1 out of 10.

RCE in Trellix Enterprise Security Manager

CVE-2023-3314

A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). Incomplete neutralization of external commands used to control the process execution of the .zip application allows an authorized user to obtain control of the .zip application to execute arbitrary commands or obtain elevation of system privileges.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.009 (57.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.

Affected products

Trellix Enterprise Security Manager — versions 11.6.3
Trellix Enterprise_security_manager

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

trellixpsirt@trellix.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-3314?: CVE-2023-3314 is a high-severity vulnerability in Trellix Enterprise Security Manager, classified under OS Command Injection. CVSS score: 8.1/10. Published 2023-07-03.
How severe is CVE-2023-3314?: High severity. CVSS v3 base score is 8.1 out of 10.