Read the docs
TI-2023-24178 Aliases CVE-2023-45162GHSA-68c3-2gxf-hpcv

Blind SQL vulnerability in 1E platform

Priority MEDIUM 44CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution.  Application of the relevant hotfix remediates this issue. for v8.1.2 apply hotfix Q23166 for v8.4.1 apply hotfix Q23164 for v9.0.1 apply hotfix Q23169 SaaS implementations on v23.7.1 will automatically have hotfix Q23173 applied. Customers with SaaS versions below this are urged to upgrade urgently - please contact 1E to arrange this

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00701 53rd percentileScored 2026-11-07
Fix Fixed 1E Platform (1E): 8.1.2, 8.4.1, 9.0.1 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
1E1E Platformbefore 8.1.2; before 8.4.1; before 9.0.1; before 23.7.18.1.2, 8.4.1, 9.0.1, 23.7.1Patch availableCNA
  • 1E Platform Vendor1E Affected before 8.1.2; before 8.4.1; before 9.0.1; before 23.7.1 Fixed in 8.1.2, 8.4.1, 9.0.1, 23.7.1 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:1e:platform:8.1.2:*:*:*:*:*:*:*8.1.2Vulnerable1E
cpe:2.3:a:1e:platform:8.4.1:*:*:*:*:*:*:*8.4.1Vulnerable1E
cpe:2.3:a:1e:platform:9.0.1:*:*:*:*:*:*:*9.0.1Vulnerable1E
cpe:2.3:a:1e:platform:23.7.1:*:*:*:*:*:*:*23.7.1Vulnerable1E
  • cpe:2.3:a:1e:platform:8.1.2:*:*:*:*:*:*:* Versions 8.1.2 Vulnerable ·1E
  • cpe:2.3:a:1e:platform:8.4.1:*:*:*:*:*:*:* Versions 8.4.1 Vulnerable ·1E
  • cpe:2.3:a:1e:platform:9.0.1:*:*:*:*:*:*:* Versions 9.0.1 Vulnerable ·1E
  • cpe:2.3:a:1e:platform:23.7.1:*:*:*:*:*:*:* Versions 23.7.1 Vulnerable ·1E

Remediation

  • Fix · CNA 1E Platform (1E) Fixed in 8.1.2, 8.4.1, 9.0.1, 23.7.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-45162
  2. 2026-10-03 Alias added: GHSA-68c3-2gxf-hpcv
  3. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 1

  • TI-2023-24179 1E-Exchange-CommandLinePing instruction before v18.1 allows for arbitrary code execution CVSS 3.1CRITICAL 9.9
  • TI-2023-24177 1E-Exchange-URLResponseTime instruction before v20.1 allows arbitrary code execution CVSS 3.1CRITICAL 9.9
  • TI-2023-05495 1E-Exchange-DisplayMessage instruction allows for arbitrary code execution CVSS 3.1CRITICAL 9.9
  • TI-2025-01448 Symbolic Link Exploit in 1E Client's - Nomad module allows Arbitrary File Deletion CVSS 3.1HIGH 7.8
  • TI-2024-06676 The Duende Identity Server based component in 1E Platform may allow URL redirections to untrusted websites. CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences