CVE-2023-46047

2024-03-2700:00:00

mitre

github.com

sane 1.2.1

local attacker

arbitrary code

crafted file

configuration file

AI Score

7.7

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

An issue in Sane 1.2.1 allows a local attacker to execute arbitrary code via a crafted file to the sanei_configure_attach() function. NOTE: this is disputed because there is no expectation that the product should be starting with an attacker-controlled configuration file.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:sane-project:sane_backends:1.2.1:*:*:*:*:*:*:*"
    ],
    "vendor": "sane-project",
    "product": "sane_backends",
    "versions": [
      {
        "status": "affected",
        "version": "1.2.1"
      }
    ],
    "defaultStatus": "unknown"
  }
]