CVE-2023-3314

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-03 · updated 2026-06-17
Weakness: CWE-78

Description

A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). Incomplete neutralization of external commands used to control the process execution of the .zip application allows an authorized user to obtain control of the .zip application to execute arbitrary commands or obtain elevation of system privileges.

Affected products

Trellix Enterprise Security Manager (ESM): before 11.6.7 — fixed in 11.6.7

How to fix

Upgrade to a fixed version: Trellix Enterprise Security Manager (ESM) 11.6.7. Check the vendor advisory for mitigations.

References

https://kcm.trellix.com/corporate/index?page=content&id=SB10403
https://kcm.trellix.com/corporate/index?page=content&id=SB10403

Get alerted when CVE-2023-3314 or the next vulnerability affects your stack