Path Traversal

🗓️ 20 Oct 2023 07:01:38Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 19 Views

github.com/arduino/arduino-create-agent is vulnerable to Directory Traversal. An attacker can delete files or folders via HTTP POST request to /v2/pkgs/tools/installed

Reporter	Title	Published	Views	Family All 18
Circl	CVE-2023-43803	19 Oct 202300:33	–	circl
CNNVD	Arduino path traversal vulnerability	18 Oct 202300:00	–	cnnvd
CVE	CVE-2023-43803	18 Oct 202320:36	–	cve
Cvelist	CVE-2023-43803 Path traversal in Arduino Create Agent	18 Oct 202320:36	–	cvelist
Debian	[SECURITY] [DLA 3649-1] python-urllib3 security update	8 Nov 202312:06	–	debian
Debian CVE	CVE-2023-43803	18 Oct 202320:36	–	debiancve
Tenable Nessus	Debian dla-3649 : python-urllib3 - security update	8 Nov 202300:00	–	nessus
EUVD	EUVD-2023-2771	3 Oct 202520:07	–	euvd
Github Security Blog	Arduino Create Agent path traversal - arbitrary file deletion vulnerability	18 Oct 202318:25	–	github
NVD	CVE-2023-43803	18 Oct 202321:15	–	nvd

Vulners

Node

arduino github.com/arduino/arduino-create-agentRange1.1.60–1.3.2go

Source	Link
github	www.github.com/arduino/arduino-create-agent/commit/9a500b4e7c41f677c77c869b71e1a524f822866d
github	www.github.com/arduino/arduino-create-agent/pull/844
github	www.github.com/advisories/GHSA-m5jc-r4gf-c6p8
github	www.github.com/arduino/arduino-create-agent/releases/tag/1.3.3
github	www.github.com/arduino/arduino-create-agent/security/advisories/GHSA-m5jc-r4gf-c6p8
lists	www.lists.debian.org/debian-lts-announce/2023/11/msg00005.html
nozominetworks	www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide

08 Nov 2023 16:39Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.16.1 - 7.1

EPSS0.00017

SSVC