CVE-2023-44689

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-11 · updated 2026-06-17
Weakness: CWE-862

Description

e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 are vulnerable to improper authorization in handler for custom URL scheme. A crafted URL may direct the product to access an arbitrary website. As a result, the user may become a victim of a phishing attack.

Affected products

E-Gov: before 1.1.1.0; before 2.1.1.0 — fixed in 1.1.1.0, 2.1.1.0

How to fix

Upgrade to a fixed version: E-Gov 1.1.1.0, 2.1.1.0. Check the vendor advisory for mitigations.

References

https://jvn.jp/en/jp/JVN15808274/
https://shinsei.e-gov.go.jp/contents/news/2023-03-12t1022040900_1318.html
https://jvn.jp/en/jp/JVN15808274/
https://shinsei.e-gov.go.jp/contents/news/2023-03-12t1022040900_1318.html

Get alerted when CVE-2023-44689 or the next vulnerability affects your stack