Lucene search

[email protected]CVE-2023-6562

HistoryDec 20, 2023 - 1:15 p.m.

CVE-2023-6562

2023-12-2013:15:07

CWE-22

CWE-434

[email protected]

web.nvd.nist.gov

cve-2023

jpx

flst

kakadu 7.9

vulnerability

exfiltration

server

upload

image.

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.8%

JSON

JPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reachable by a server if the server allows the attacker to upload a specially-crafted the image that is displayed back to the attacker.

Affected configurations

Vulners

NVD

Node

kakadu_software_pty_ltdkakadu_sdkRange4.4–8.4

CPENameOperatorVersion
kakadusoftware:kakadu_sdkkakadusoftware kakadu sdkle8.4

CPE	Name	Operator	Version
kakadusoftware:kakadu_sdk	kakadusoftware kakadu sdk	le	8.4

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "packageName": "JPEG 2000, JPX",
    "product": "Kakadu SDK",
    "vendor": "Kakadu Software Pty Ltd",
    "versions": [
      {
        "lessThan": "8.4",
        "status": "affected",
        "version": "4.4",
        "versionType": "python"
      }
    ]
  }
]

References

github.com/google/security-research/security/advisories/GHSA-g6qc-fhcq-vhf9

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.8%

JSON

Related for CVE-2023-6562

prion1 cvelist1 nvd1