Lucene search

GoogleOSV:CVE-2023-40299

HistoryOct 04, 2023 - 10:15 p.m.

CVE-2023-40299

2023-10-0422:15:09

Google

osv.dev

kong insomnia

security vulnerability

macos

code execution

restricted files

dyld_insert_libraries

tcc permissions

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.7%

JSON

Kong Insomnia 2023.4.0 on macOS allows attackers to execute code and access restricted files, or make requests for TCC permissions, by using the DYLD_INSERT_LIBRARIES environment variable.

References

github.com/Kong/insomnia/pull/6217/commits

github.com/Kong/insomnia/releases

insomnia.rest/changelog

www.angelystor.com/posts/cve-2023-40299/

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.7%

JSON

Related for OSV:CVE-2023-40299