cve/2023/CVE-2023-45160.md

### [CVE-2023-45160](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45160)
![](https://img.shields.io/static/v1?label=Product&message=1E%20Client&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%3D%208.1.2.62%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-552%20Files%20or%20Directories%20Accessible%20to%20External%20Parties&color=brighgreen)

### Description

In the affected version of the 1E Client, an ordinary user could subvert downloaded instruction resource files, e.g., to substitute a harmful script. by replacing a resource script file created by an instruction at run time with a malicious script. The 1E Client's temporary directory is now locked down in the released patch.Resolution: This has been fixed in patch Q23094 This issue has also been fixed in the Mac Client in updated versions of Non-Windows release v8.1.2.62 - please re-download from the 1E Support site. Customers with Mac Client versions higher than v8.1 will need to upgrade to v23.11 to remediate this vulnerability.

### POC

#### Reference
- https://www.1e.com/vulnerability-disclosure-policy/

#### Github
No PoCs found on GitHub currently.