CVE-2023-35853

Katalog CVE

CVSS 9.8 · Critical EPSS 1,0%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada oisf suricata. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section.

Rincian

Terbit di NVD

19 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OISF/suricata/commit/b95bbcc66db526ffcc880eb439dbe8abc87a81da patch · advisory vendor
• https://github.com/OISF/suricata/compare/suricata-6.0.12...suricata-6.0.13 advisory vendor
• https://www.stamus-networks.com/stamus-labs not applicable