7.8 - CVE-2023-43800

Executive Summary

Informations
Name	CVE-2023-43800	First vendor Publication	2023-10-18
Vendor	Cve	Last vendor Modification	2023-11-02

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Overall CVSS Score	7.8
Base Score	7.8	Environmental Score	7.8
impact SubScore	5.9	Temporal Score	7.8
Exploitabality Sub Score	1.8

Attack Vector	Local	Attack Complexity	Low
Privileges Required	Low	User Interaction	None
Scope	Unchanged	Confidentiality Impact	High
Integrity Impact	High	Availability Impact	High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score	N/A	Attack Range	N/A
Cvss Impact Score	N/A	Attack Complexity	N/A
Cvss Expoit Score	N/A	Authentication	N/A
Calculate full CVSS 2.0 Vectors scores

Detail

Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43800

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-345	Insufficient Verification of Data Authenticity

CPE : Common Platform Enumeration

Type	Description	Count
Application	Arduino Create Agent cpe:2.3:a:arduino:create_agent::::::go::*	1

Sources (Detail)

Source	Url
MISC	https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3 https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-4x5q... https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-...