In the affected version of the 1E Client, an ordinary user could subvert downloaded instruction resource files, e.g., to substitute a harmful script. by replacing a resource script file created by an instruction at run time with a malicious script. This has been fixed in patch Q23094 as the 1E Client's temporary directory is now locked down

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-45160
• https://www.1e.com/trust-security-compliance/cve-info/
• https://1e.my.site.com/s/
• https://www.1e.com/vulnerability-disclosure-policy/