Lucene search

MitreCVE-2023-23558

HistoryFeb 16, 2023 - 4:15 p.m.

CVE-2023-23558

2023-02-1616:15:12

CWE-59

mitre

web.nvd.nist.gov

eternal terminal

telemetryservice

fixed path

vulnerability

cve-2023-23558

nvd

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

5.9

Confidence

High

EPSS

Percentile

5.1%

JSON

In Eternal Terminal 6.2.1, TelemetryService uses fixed paths in /tmp. For example, a local attacker can create /tmp/.sentry-native-etserver with mode 0777 before the etserver process is started. The attacker can choose to read sensitive information from that file, or modify the information in that file.

Affected configurations

Nvd

Node

eternal_terminal_projecteternal_terminalMatch6.2.1

VendorProductVersionCPE
eternal_terminal_projecteternal_terminal6.2.1cpe:2.3:a:eternal_terminal_project:eternal_terminal:6.2.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
eternal_terminal_project	eternal_terminal	6.2.1	cpe:2.3:a:eternal_terminal_project:eternal_terminal:6.2.1:::::::*

References

www.openwall.com/lists/oss-security/2023/02/16/1

bugzilla.suse.com/show_bug.cgi?id=1207126

github.com/MisterTea/EternalTerminal

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

5.9

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2023-23558