CVE-2023-24540
criticalpriority · track · 40EPSS 0.016 · 75 %ileDEEURUUSEPSS · scored 2026-10-27
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedphoenix_contact_psirt
PHOENIX CONTACT strongly recommends affected users to upgrade to CodeMeter V7.60d,which fixes these vulnerabilities. WIBU-SYSTEMS has already published an update forCodeMeter on their homepage. Since this current version of CodeMeter V7.60d has not yetbeen incorporated into Phoenix Contact products, we strongly recommend to download andinstall the current CodeMeter version directly from the WIBU-SYSTEMS homepage.Update Phoenix Contact Activation Wizard to version 1.7 when available. Please check the Phoenix Contact e-Shop for your related Software product regularly.
- Fixedtrumpf_psirt
Get the latest version of the TRUMPF License Expert software (V2.1.0) here and install it onall affected servers and workstations.
- Mitigationphoenix_contact_psirt
Disable using a SOCKS5 proxy: The proxy environment variables HTTP_PROXY, HTTPS_PROXY and ALL_PROXYmust not be set to socks5h:// Ensure that CodeMeter is not defined to use the SOCKS5 proxy. The variableProxyServer must not be start with socks5h://. On Windows, the definition of that variable is in the registry (regedit) underHKLM/SOFTWARE/WIBU-SYSTEMS/CodeMeter/Server/CurrentVersion On Mac, the definition of that variable is in the file/Library/Preferences/com.wibu.CodeMeter.Server.ini On Linux, the definition of that variable is in the file/etc/wibu/CodeMeter/Server.ini On Solaris, the definition of that variable is in the file/etc/opt/CodeMeter/Server.iniUse general security best practices to protect systems from local and network attacks likedescribed in the application node AH EN INDUSTRIAL SECURITY.
- Mitigationtrumpf_psirt
CVE-2023-38545 only appears when used together with a SOCKS-5 Proxy. Not using theaffected products via a SOCKS-5 proxy mitigates the vulnerability.
- Mitigationwago_psirt
Disable using a SOCKS5 proxy: The proxy environment variables HTTP_PROXY, HTTPS_PROXY and ALL_PROXY must not be set to socks5h:// Ensure that CodeMeter is not defined to use the SOCKS5 proxy. The variable ProxyServer must not be start with socks5h://. On Windows, the definition of that variable is in the registry (regedit) under HKLM/SOFTWARE/WIBU-SYSTEMS/CodeMeter/Server/CurrentVersion On Mac, the definition of that variable is in the file /Library/Preferences/com.wibu.CodeMeter.Server.ini On Linux, the definition of that variable is in the file /etc/wibu/CodeMeter/Server.ini On Solaris, the definition of that variable is in the file/etc/opt/CodeMeter/Server.ini For further details on risk mitigation and impact of this vulnerability, please refer to the official WIBU-SYSTEMS Product Security Advisories WIBU-231024-01 and WIBU-231017-01 at Website https://www.wibu.com/support/security-advisories.html. Until an update is available for e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) we strongly encourage users to update WIBU-SYSTEMS Codemeter by installing the latest available stand-alone WIBU-SYSTEMS Codemeter Version.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (114)
Products and version ranges known to be affected.
- Xerox FreeFlow Print Server v7 for Solarisall versionscert_bundDEcpe:/a:xerox:freeflow_print_server:v7_for_solaris
advisories (9)
Vendor and ecosystem advisories describing this.
- VDE-2023-062Phoenix Contact: WIBU-SYSTEMS CodeMeter Runtime vulnerabilities in multiple products2023-11-21csaf · phoenix_contact_psirtDE
A heap-based buffer overflow caused by libcurl and wrong whitespace character interpretationin Javascript, both used in CodeMeter Runtime affecting multiple products by PHOENIX CONTACT.
- VDE-2024-001TRUMPF: Multiple products contain WIBU CodeMeter vulnerabilities2024-01-29csaf · trumpf_psirtDE
The TRUMPF CAD/CAM software tools mentioned above use the vulnerable CodeMeter Runtime (up to version 7.60d) application from WIBU-SYSTEMS AG to manage licenses within the component TRUMPF License Expert. This CodeMeter application contains new vulnerabilities, which may enable an attacker to gain full access to the server or workstation on which the TRUMPF License Expert has been installed on. A new version of the TRUMPF License Expert which fixes these vulnerabilities is available.
- VDE-2024-007WAGO: WIBU-SYSTEMS CodeMeter Runtime vulnerabilities in multiple products2024-01-22csaf · wago_psirtDE
A heap-based buffer overflow caused by libcurl and wrong whitespace character interpretation in Javascript, both used in CodeMeter Runtime affecting multiple products by WAGO. WIBU-SYSTEMS Codemeter is installed by default during e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) installations.
- WID-SEC-W-2023-1167Gitea: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2023-05-08csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- WID-SEC-W-2023-1378Red Hat OpenShift Container Platform: Mehrere Schwachstellen ermöglichen Umgehen von SicherheitsvorkehrungenDeutsch2023-06-06csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in der Red Hat OpenShift Container Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2023-2031Xerox FreeFlow Print Server: Mehrere SchwachstellenDeutsch2023-08-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
- WID-SEC-W-2023-2229Splunk Splunk Enterprise: Mehrere SchwachstellenDeutsch2023-08-30csaf · cert_bundDE
Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, einen 'Denial of Service'-Zustand zu verursachen, seine Privilegien zu erweitern und weitere, nicht spezifizierte Auswirkungen zu verursachen.
- BIT-golang-2023-24540Improper handling of JavaScript whitespace in html/template2024-03-06vendor · osvUS
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
- GO-2023-1752Improper handling of JavaScript whitespace in html/template2023-05-05vendor · osvUS
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.
also known as (6)
Other names and identifiers for this entity.
- CNNVD-202305-373cnnvd
- EUVD-2023-28556enisa_euvd
- BDU:2023-03471fstec_bdu
- GHSA-7qhm-5mxq-x7vpenisa_euvd
- BIT-golang-2023-24540osv
- GO-2023-1752osv
sources
Which sources assert this record, and when.
references (34)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-24540/cnnvd
- https://go.dev/cl/491616cnnvd
- https://go.dev/issue/59721cnnvd
- https://groups.google.com/g/golang-announce/c/MEb0UyuSMsUcnnvd
- https://pkg.go.dev/vuln/GO-2023-1752cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.2526cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.3052cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.3116cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan