Lucene search

[email protected]NVD:CVE-2023-40361

HistoryOct 20, 2023 - 6:15 a.m.

CVE-2023-40361

2023-10-2006:15:17

CWE-732

[email protected]

web.nvd.nist.gov

secudos qiata

insecure permissions

previewrm.sh

daily cronjob

domos system

low-privileged user

root user

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

Percentile

9.0%

JSON

SECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. To exploit this, an attacker needs access as a low-privileged user to the underlying DOMOS system. Every user on the system has write permission for previewRm.sh, which is executed by the root user.

Affected configurations

Nvd

Node

secudosqiataMatch4.13

VendorProductVersionCPE
secudosqiata4.13cpe:2.3:a:secudos:qiata:4.13:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
secudos	qiata	4.13	cpe:2.3:a:secudos:qiata:4.13:::::::*

References

github.com/vianic/CVE-2023-40361/blob/main/advisory/advisory.md

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for NVD:CVE-2023-40361

prion1 cvelist1 vulnrichment1 cve1