CVE-2023-2270

Katalog CVE

CVSS 7.8 · High EPSS 0,27%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada netskope. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to start various services and execute commands. The connection handling function of Netskope client before R100 in this service utilized a relative path to download and unzip configuration files on the machine. This relative path provided a way for local users to write arbitrary files at a location which is accessible to only higher privileged users. This can be exploited by local users to execute code with NT\SYSTEM privileges on the end machine.

Rincian

Terbit di NVD

15 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskop... advisory vendor