Lucene search

K
nvd[email protected]NVD:CVE-2023-32077
HistoryAug 24, 2023 - 10:15 p.m.

CVE-2023-32077

2023-08-2422:15:08
CWE-798
CWE-321
web.nvd.nist.gov
3
netmaker
wireguard
dns api
vulnerability
patch
upgrade

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.136

Percentile

95.7%

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6. If users are using 0.17.1, they should run docker pull gravitl/netmaker:v0.17.1 and docker-compose up -d. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.

Affected configurations

Nvd
Node
gravitlnetmakerRange<0.17.1
OR
gravitlnetmakerRange0.18.00.18.5
VendorProductVersionCPE
gravitlnetmaker*cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.136

Percentile

95.7%

Related for NVD:CVE-2023-32077