CVE-2023-46122

2023-10-2316:15:09

CWE-22

[email protected]

web.nvd.nist.gov

sbt

build tool

scala

java

cve-2023-46122

security vulnerability

file writing

unauthorized access

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.2%

JSON

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. This would have potential to overwrite /root/.ssh/authorized_keys. Within sbt’s main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however many projects use IO.unzip(...) directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.

Affected configurations

Vulners

NVD

Node

sbtsbtRange0.3.4–1.9.7

CPENameOperatorVersion
scala-sbt:ioscala-sbt iolt1.9.7
scala-sbt:sbtscala-sbt sbtlt1.9.7

CPE	Name	Operator	Version
scala-sbt:io	scala-sbt io	lt	1.9.7
scala-sbt:sbt	scala-sbt sbt	lt	1.9.7

CNA Affected

[
  {
    "vendor": "sbt",
    "product": "sbt",
    "versions": [
      {
        "version": ">= 0.3.4, < 1.9.7",
        "status": "affected"
      }
    ]
  }
]