CVE-2023-43783

Katalog CVE

CVSS 7.5 · High EPSS 0,76%

Kerentanan Exposure of Resource to Wrong Sphere pada falktx cadence. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/cadence-wineasio.reg Temporary File. The filename is used even if it has been created by a local adversary before Cadence started. The adversary can leverage this to create or overwrite files via a symlink attack. In some kernel configurations, code injection into the Wine registry is possible.

Rincian

Terbit di NVD

22 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

0,76% peluang dieksploitasi; lebih tinggi dari 54,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.openwall.com/lists/oss-security/2023/10/05/4 exploit · mailing list
• https://bugzilla.suse.com/show_bug.cgi?id=1213985 issue tracking
• https://github.com/falkTX/Cadence product