Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-43802

Date: October 18, 2023

Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint "/upload" which handles request with the "filename" parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate their privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version "1.3.3". Users are advised to upgrade. There are no known workarounds for this vulnerability.

Language: Go

Severity Score

Related Resources (6)

https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide
https://github.com/arduino/arduino-create-agent
https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-75j7-w798-cwwx
https://nvd.nist.gov/vuln/detail/CVE-2023-43802
https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3
https://www.mend.io/vulnerability-database/CVE-2023-43802

Severity Score

Weakness Type (CWE)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22

Path Traversal: '.../...//'

CWE-35

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us