CVE-2023-5183

Published: Sep 27, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to exploit this vulnerability. The flaw exists within the network_traffic API endpoint. An attacker can leverage this vulnerability to execute code in the context of the PCE’s operating system user.

Affected (6)

Products: Illumio: Core Policy Compute Engine

Illumio

1 product

Core Policy Compute Engine

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Illumio Core Policy Compute Engine	Before 19.3.7
Illumio Core Policy Compute Engine	From 21.2.0 to 21.2.8
Illumio Core Policy Compute Engine	From 21.5.0 to 21.5.36
Illumio Core Policy Compute Engine	From 22.2.0 to 22.2.42
Illumio Core Policy Compute Engine	From 22.5.0 to 22.5.31
Illumio Core Policy Compute Engine	From 23.2.0 to 23.2.11

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://docs.illumio.com/Guides/security-advisories/september-2023/cve-2023-5183.htm

Source: security@illumio.com

Vendor Advisory

https://docs.illumio.com/Guides/security-advisories/september-2023/cve-2023-5183.htm

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.