SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer
A vulnerability in Nullsoft Scriptable Installer System (NSIS) software (CVE-2023-37378) used in Parasolid installers before V36 creates an “uninstall directory” with insufficient access control. This could allow an attacker to misuse the vulnerability, and potentially escalate privileges. Only systems where Parasolid is installed with a Parasolid installer is impacted. Siemens recommends to uninstall impacted Parasolid instances and reinstall with the latest installer available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-37378US | medium5.3 | — | ||
Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory. | ||||
references
External citations — patches, advisories, analysis.
- SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer - CSAF Versionself
- SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer - HTML Versionself
- SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer - PDF Versionself
- SSA-116172: Nullsoft Scriptable Install System (NSIS) Vulnerability (CVE-2023-37378) in Parasolid Installer - TXT Versionself
remediations (6)
- MitigationParasolid V35.0
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts
- MitigationParasolid V35.1
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts
- FixedParasolid V35.0
Run the uninstaller to remove the vulnerable directory and reinstall with the latest installer available for download
https://support.sw.siemens.com/en-US/product/258316782/ - FixedParasolid V35.1
Run the uninstaller to remove the vulnerable directory and reinstall with the latest installer available for download
https://support.sw.siemens.com/en-US/product/258316782/ - WorkaroundParasolid V35.0
Scan each computer where Parasolid has ever been installed with an up-to-date anti-virus program and follow its recommendations
- WorkaroundParasolid V35.1
Scan each computer where Parasolid has ever been installed with an up-to-date anti-virus program and follow its recommendations
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan