Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2023-39423

Improper Neutralization of Special Elements used in an SQL Command in RDPData.dll

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Bitdefender

Description

The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs,  among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Resort Data Processing, Inc. IRM Next Generation

Default version status: unaffected

  • 5.3.2.15affected

References