CVE-2023-50439

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-13 · updated 2026-06-17

Description

ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission), ZED! for Windows before Q.2021.2 (ANSSI qualification submission), ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission), ZONECENTRAL for Windows before 2023.5, or ZEDMAIL for Windows before 2023.5 disclose the original path in which the containers were created, which allows an unauthenticated attacker to obtain some information regarding the context of use (project name, etc.).

Affected products

Primx Zed!: before q.2020.3; from 2023.0 before 2023.5; from q.2021.0 before q.2021.2 — fixed in 2023.5, q.2020.3, q.2021.2
Primx Zedmail: before 2023.5 — fixed in 2023.5
Primx Zonecentral: before q.2021.2; from 2023.0 before 2023.5 — fixed in 2023.5, q.2021.2

How to fix

Upgrade to a fixed version: Primx Zed! 2023.5, q.2020.3, q.2021.2; Primx Zedmail 2023.5; Primx Zonecentral 2023.5, q.2021.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-50439 or the next vulnerability affects your stack