CVE-2023-34460

Katalog CVE

CVSS 9.8 · Critical EPSS 0,65%

Kerentanan Improper Authorization pada tauri. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the `fs` endpoint are affected. The regression has been patched on version 1.4.1.

Rincian

Terbit di NVD

23 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tauri-apps/tauri/commit/066c09a6ea06f42f550d090715e06beb65cd5564 patch
• https://github.com/tauri-apps/tauri/pull/6969#discussion_r1232018347 issue tracking · patch
• https://github.com/tauri-apps/tauri/pull/7227 patch
• https://github.com/tauri-apps/tauri/security/advisories/GHSA-wmff-grcw-jcfm advisory pihak ketiga