CVE-2023-43801

🗓️ 18 Oct 2023 21:06:12Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 113 Views🌐 WEB

Arduino Create Agent vulnerability in endpoint handling plugin names input. Arbitrary file/folder deletion via crafted HTTP DELETE request

Reporter	Title	Published	Views	Family All 13
CNNVD	Arduino path traversal vulnerability	18 Oct 202300:00	–	cnnvd
Cvelist	CVE-2023-43801 Path traversal in Arduino Create Agent	18 Oct 202321:06	–	cvelist
EUVD	EUVD-2023-2775	3 Oct 202520:07	–	euvd
Github Security Blog	Arduino Create Agent path traversal - arbitrary file deletion vulnerability	18 Oct 202317:34	–	github
Mend	CVE-2023-43801	18 Oct 202321:06	–	mend
NVD	CVE-2023-43801	18 Oct 202322:15	–	nvd
osv_cve	CVE-2023-43801 Path traversal in Arduino Create Agent	18 Oct 202321:06	–	osv_cve
osv_ghsa	GHSA-MJQ6-PV9C-QPPQ Arduino Create Agent path traversal - arbitrary file deletion vulnerability	18 Oct 202317:34	–	osv_ghsa
Prion	Design/Logic Flaw	18 Oct 202322:15	–	prion
Positive Technologies	PT-2023-28994 · Arduino · Arduino Create Agent	18 Oct 202300:00	–	ptsecurity

NVD

Vulners

Node

arduino create_agentRange<1.3.3go

[
  {
    "vendor": "arduino",
    "product": "arduino-create-agent",
    "versions": [
      {
        "version": "< 1.3.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
nozominetworks	www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide
github	www.github.com/arduino/arduino-create-agent/releases/tag/1.3.3
github	www.github.com/arduino/arduino-create-agent/security/advisories/GHSA-mjq6-pv9c-qppq

Parameter	Position	Path	Description	CWE
plugin names	request body	/v2/pkgs/tools/installed	The endpoint handles plugin names supplied as user input in a way that allows an attacker to delete arbitrary files or folders via a crafted HTTP DELETE request.	CWE-22

17 Jun 2026 06:26Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.16.1 - 7.1

EPSS0.00342

SSVC

CWE-22