Dimension
CVE-2023-25903
HIGH
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS score of 7.8 (HIGH). Attack characteristics: local attack vector, low complexity, no privileges required, user interaction required. |
| Exploit ScenarioDerived | A local attacker with access to the system could cause unexpected behavior through arithmetic overflow. No authentication is required to exploit this vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Adobe Dimension versions 3.4.7 (and earlier) is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Validate arithmetic operations, use safe integer libraries, check bounds before allocation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as Integer Overflow (CWE-190), which allows attackers to cause unexpected behavior through arithmetic overflow. Adobe Dimension versions 3.4.7 (and earlier) is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Affected products include: Adobe Dimension.
Know when Dimension gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Dimension versions 3.4.7 (and earlier) is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Privilege escalation to account takeover in WatchGuard Dimension allows a low-privileged Dimension Administrator to hija
WatchGuard Dimension's log listening service can be rendered unavailable by an unauthenticated remote attacker flooding
Authenticated SQL injection in WatchGuard Dimension's scheduled report feature permits arbitrary OS command execution as
Authenticated SQL injection in WatchGuard Dimension's audit report feature enables privilege escalation to arbitrary OS
WatchGuard Dimension's log viewer feature exposes an SQL injection flaw that escalates directly to arbitrary command exe
WatchGuard Dimension's Web UI administrator passphrase change endpoint lacks CSRF protection, enabling full account take
Arbitrary code execution in Adobe Dimension 4.1.4 and earlier is possible through a use-after-free (CWE-416) triggered w
Opening a maliciously crafted file in Adobe Dimension 4.1.4 and earlier can trigger an integer overflow (CWE-190) during
Out-of-bounds read in Adobe Dimension 4.1.4 and earlier can be escalated to code execution in the context of the current
An out-of-bounds read during file parsing in Adobe Dimension 4.1.4 and earlier can lead to code execution in the context
Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary
Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary
GitHub PoC
Exploit-DB