Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:41421
HistoryJul 20, 2023 - 10:35 a.m.

Information Disclosure

2023-07-2010:35:34
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
6
agpt
information disclosure
docker container
python code
vulnerability
software

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

0

Percentile

9.0%

agpt is vulnerable to Information Disclosure. The vulnerability exists because it does not properly restrict writing to the docker-compose.yml, which allows an attacker to inject malicious custom Python code into the system the next time the docker container is run by overwriting the compose file.

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

0

Percentile

9.0%

Related for VERACODE:41421