Summary
A vulnerability in Nullsoft Scriptable Installer System (NSIS) software (CVE-2023-37378) used in Parasolid installers before V36 creates an “uninstall directory” with insufficient access control. This could allow an attacker to misuse the vulnerability, and potentially escalate privileges.
Only systems where Parasolid is installed with a Parasolid installer is impacted. Siemens recommends to uninstall impacted Parasolid instances and reinstall with the latest installer available.
Vulnerabilities 1
-
Unscored —
Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.
Revision history
-
#1
Publication Date
References
-
SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-116172.html
-
SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-116172.pdf
-
SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-116172.txt