CVE-2023-38127
Estado: ModificadaAlta (7.8)—
An integer overflow exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause the parser to make an under-sized allocation, which can later allow for memory corruption, potentially resulting in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.65%
- Percentil entre todas las CVEs puntuadas: 49
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (19)
Justsystems — Easy Postcard MAXJustsystems — Ichitaro 2021Justsystems — Ichitaro 2022Justsystems — Ichitaro 2023Justsystems — Ichitaro Government 10Justsystems — Ichitaro Government 8Justsystems — Ichitaro Government 9Justsystems — Ichitaro PRO 3Justsystems — Ichitaro PRO 4Justsystems — Ichitaro PRO 5Justsystems — Just Government 3Justsystems — Just Government 4Justsystems — Just Government 5Justsystems — Just Office 3Justsystems — Just Office 4Justsystems — Just Office 5Justsystems — Just Police 3Justsystems — Just Police 4Justsystems — Just Police 5
CWE
- CWE-190
- CWE-190
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-38127",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-38127",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-09-12T19:06:59.215037Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "talos-cna@cisco.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "talos-cna@cisco.com",
"affectedData": [
{
"vendor": "Ichitaro 2023",
"product": "Ichitaro 2023",
"versions": [
{
"status": "affected",
"version": "1.0.1.59372"
}
]
}
]
}
],
"published": "2023-10-19T18:15:09.467",
"references": [
{
"url": "https://jvn.jp/en/jp/JVN28846531/index.html",
"tags": [
"Third Party Advisory"
],
"source": "talos-cna@cisco.com"
},
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1808",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "talos-cna@cisco.com"
},
{
"url": "https://jvn.jp/en/jp/JVN28846531/index.html",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1808",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1808",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "talos-cna@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-190"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-190"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An integer overflow exists in the \"HyperLinkFrame\" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause the parser to make an under-sized allocation, which can later allow for memory corruption, potentially resulting in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability."
},
{
"lang": "es",
"value": "Existe un desbordamiento de enteros en el analizador de flujo \"HyperLinkFrame\" de Ichitaro 2023 1.0.1.59372. Un documento especialmente manipulado puede hacer que el analizador realice una asignación de tamaño insuficiente, lo que posteriormente puede permitir la corrupción de la memoria, lo que podría provocar la ejecución de código arbitrario. Un atacante puede proporcionar un archivo malicioso para desencadenar esta vulnerabilidad."
}
],
"lastModified": "2026-06-17T06:09:29.507",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:justsystems:easy_postcard_max:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D68E98B0-38CA-4148-825D-CF7C8AABB5BE"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_2021:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1755383C-2B74-4DD7-9C9B-DB19C12CA94D"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_2022:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1274E0AB-BDE0-45FB-B3A2-522E3AE4E41A"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_2023:1.0.1.59372:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "15B1DC82-380D-4CF4-AF35-4AF2A1CBF778"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_government_10:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A1C403A-6787-4347-AF6F-69F225944011"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_government_8:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E401B098-6551-4101-9906-19C2AB7A5504"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_government_9:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "65A56D02-7438-4319-BFD1-64FB11BC758C"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_pro_3:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36AE4633-5418-4009-B51D-4A1F542B1A88"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_pro_4:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21A4F85C-EA95-4853-9A8C-C3C9142243A8"
},
{
"criteria": "cpe:2.3:a:justsystems:ichitaro_pro_5:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "76FAE0E6-1037-45AC-A277-8F32338A50AD"
},
{
"criteria": "cpe:2.3:a:justsystems:just_government_3:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "552D41EF-A5DB-4ED0-B404-FF2649969B11"
},
{
"criteria": "cpe:2.3:a:justsystems:just_government_4:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1F61D3C1-0011-4D78-83F8-2349D46AFE59"
},
{
"criteria": "cpe:2.3:a:justsystems:just_government_5:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC99A5A2-32B0-4F38-A2B1-FAC50A05FBEF"
},
{
"criteria": "cpe:2.3:a:justsystems:just_office_3:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7814DB96-4078-47B8-93B2-5066029B6F65"
},
{
"criteria": "cpe:2.3:a:justsystems:just_office_4:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D8E2A1A-7C06-491F-8A28-BE70EFCDDFFF"
},
{
"criteria": "cpe:2.3:a:justsystems:just_office_5:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD6F3523-7059-4591-9D04-97D287128D6E"
},
{
"criteria": "cpe:2.3:a:justsystems:just_police_3:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5ED46089-ED5B-4314-B079-A8932377475E"
},
{
"criteria": "cpe:2.3:a:justsystems:just_police_4:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C3B6B97E-B202-4B1F-9B81-367CB7172DEB"
},
{
"criteria": "cpe:2.3:a:justsystems:just_police_5:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B5D80C5-5821-416E-A3E3-ADC7F221B093"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "talos-cna@cisco.com"
}