CVE-2023-49329 is a high severity OS command injection flaw, scored 7.2, in Anomali Match before 4.6.2. An authenticated admin can run operating system commands on the server. The record lists fixed versions 4.4.5, 4.5.4 and 4.6.2, so upgrade within your own release line and trim admin accounts.
What's affected
The record says Anomali Match before 4.6.2 allows OS command injection, that the fixed versions are 4.4.5, 4.5.4 and 4.6.2, and that the earliest affected version is 4.3. In practice that means each release line has its own fix: 4.4.x users move to 4.4.5, 4.5.x users to 4.5.4 and 4.6.x users to 4.6.2.
The NVD vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, with high privileges required. I tried to read the vendor advisory ANML-2023-01 that the record links, and the page returned not found, so this post relies on the NVD description for versions. Check the vendor's current security pages to confirm.
How to check if you're exposed
Open the product's version information in the administration interface and note the version. Compare it with the three fixed versions above, matching your release line.
Because I could not read the vendor advisory, confirm the fixed build with Anomali support if your version sits between lines, for example anything in the 4.3 line.
What to do now
- Find the installed Anomali Match version and its release line.
- Upgrade to 4.4.5, 4.5.4 or 4.6.2, whichever is in your line. Versions in the 4.3 line need a move to a fixed line, so confirm the path with the vendor.
- List who holds admin accounts in the product and remove any that are unneeded, since the flaw needs an authenticated admin.
- Enable multi factor authentication for admin sign in if the product supports it.
- Review the host for unexpected processes or accounts if you ran an affected version with many admins.
Why it matters
The weakness is OS command injection, CWE-78. Per the record, untrusted input is handled improperly, which lets an administrator run operating system commands, raise privileges and potentially compromise the underlying operating system.
The high privilege requirement lowers the score to 7.2, but it matters in security tooling. An admin account on a threat intelligence platform is a valuable credential, and flaws like this turn it from application admin into server control. KEV status is false for this CVE, so this post makes no claim of exploitation.
Quick check
Why is this only rated high when it reaches the OS?
The attacker must already be an authenticated admin, shown as PR:H in the vector. That lowers the score below critical even though the impact is high.
Sources
NVD record data for CVE-2023-49329 (vendor advisory ANML-2023-01 returned not found when fetched)
Last reviewed: 19 October 2026.
