Home > Vulnerability Database > CVE-2023-43803

Mend.io Vulnerability Database

CVE-2023-43803

Date: October 18, 2023

Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint "/v2/pkgs/tools/installed" and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP POST request. This issue has been addressed in version "1.3.3". Users are advised to upgrade. There are no known workarounds for this vulnerability.

Language: Go

Severity Score

6.1

Related Resources (7)

Url: https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide

Url: https://github.com/arduino/arduino-create-agent

Url: https://nvd.nist.gov/vuln/detail/CVE-2023-43803

Url: https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-m5jc-r4gf-c6p8

Url: https://lists.debian.org/debian-lts-announce/2023/11/msg00005.html

Url: https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3

Url: https://www.mend.io/vulnerability-database/CVE-2023-43803

Severity Score

6.1

Weakness Type (CWE)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22

Path Traversal: '.../...//'

CWE-35

CVSS v3.1

Base Score:	6.1
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	HIGH
Availability (A):	LOW

Mend.io Vulnerability Database

We found results for “”

CVE-2023-43803

Date: October 18, 2023

Language: Go

Severity Score

Related Resources (7)

Severity Score

Weakness Type (CWE)

CVSS v3.1

Do you need more information?