CVE-2022-47636

A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Language), the application will load the following DLLs from the same directory av_libGLESv2.dll, libcef.DLL, user32.dll, and d3d10warp.dll. Using a crafted DLL, it is possible to execute arbitrary code in the context of the current logged in user.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

1.28% chance of exploitation in the next 30 days, 68th percentile

Published

2023-08-10

Updated

2024-10-10

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/174127/OutSystems-Service-Studio-11.53.30-DLL-Hijack…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51678

References

• CVE Record
• NVD entry

Related

• CVE-2022-47632
• CVE-2022-4764
• CVE-2022-47631
• CVE-2022-4765
• CVE-2022-4763
• CVE-2022-47653