CVE-2023-49582

2024-08-2614:15:07

CWE-732

apache

web.nvd.nist.gov

apache portable runtime

unix platforms

shared memory.

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

Low

EPSS

Percentile

5.0%

JSON

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.

This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h)

Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.

Affected configurations

Nvd

Vulners

Node

apacheportable_runtimeRange0.9.0–1.7.5

VendorProductVersionCPE
apacheportable_runtime*cpe:2.3:a:apache:portable_runtime:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	portable_runtime	*	cpe:2.3:a:apache:portable_runtime::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Portable Runtime (APR)",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.7.4",
        "status": "affected",
        "version": "0.9.0",
        "versionType": "semver"
      }
    ]
  }
]