CVE-2023-42404 is a medium severity flaw (CVSS 4.9) in OneVision Workspace. It allows arbitrary Java Expression Language execution in versions before WS23.1 SR1, build w31.040. Update to that build or a later one, and confirm the right fixed build for your release line with OneVision.
What's affected
The CVE record says OneVision Workspace before WS23.1 SR1 (build w31.040) is affected. Code White's public vulnerability list shows the issue with these thresholds by release line: before WS22.1 SR1 (build w29.032), before WS22.2 SR3 (build w30.044) and before WS23.1 SR1 (build w31.040).
I could not find a public OneVision advisory page for this issue, since the vendor reference in the record is the company home page. Confirm affected and fixed builds with OneVision support or your account contact.
How to check if you're exposed
Find the build number of each Workspace installation. It is shown in the product's About information or in the installation directory of the server. Compare it with the thresholds above, using the line that matches your release.
Then check who can reach the Workspace server. The record scores the attack as needing low privileges and high complexity, so a signed in user is the usual starting point. A smaller group of users with accounts shrinks the exposure.
If you cannot find a version, ask the vendor. Do not assume that a missing entry in a scanner means safety, because this is commercial software that dependency tools do not cover well.
What to do now
- Identify OneVision Workspace servers and read the installed build.
- Ask OneVision for the fixed build for your release line, and apply it.
- Limit access to the server to the users and networks that need it.
- Review the accounts that have access, and remove dormant ones.
- Keep the vendor's update notices in your monitoring so later security releases do not pass unnoticed.
Why it matters
The weakness is code injection (CWE-94). Java Expression Language is a small language that applications use to evaluate expressions at run time. If user supplied text reaches the evaluator without checks, a user can have the server evaluate expressions of their own, and expression languages can reach far into the host environment.
The score of 4.9 is moderate because the record asks for a signed in user and high complexity. It also marks the scope as changed, meaning the impact may reach beyond the vulnerable component. The CVE is not on the CISA Known Exploited Vulnerabilities list, and I found no source that describes exploitation. Treat it as a planned update, and prioritise it higher if untrusted users have accounts.
Quick check
Where is the vendor advisory?
The record points to the company home page, and no advisory page was found. Contact OneVision for the fixed build for your release line.
Is the issue exploited in the wild?
Nothing fetched for this post says so, and the CVE is not on the CISA Known Exploited Vulnerabilities list.
Sources
Last reviewed: 19 October 2026.
