CVE-2023-23558 Path traversal in n/a
A local attacker can exploit fixed temporary file paths to read or modify sensitive telemetry data in Eternal Terminal.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-23558?
CVE-2023-23558 is a medium-severity path traversal vulnerability in n/a, published on 16 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Eternal Terminal 6.2.1, TelemetryService uses fixed paths in /tmp. For example, a local attacker can create /tmp/.sentry-native-etserver with mode 0777 before the etserver process is started. The attacker can choose to read sensitive information from that file, or modify the information in that file.
Weakness: CWE-59
Which versions are affected by CVE-2023-23558?
It affects 1 product.
Products include Eternal Terminal Project Eternal Terminal.
How do I fix CVE-2023-23558?
No fix has been published for CVE-2023-23558 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-23558 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-23558 exists.
Other vulnerabilities in n/a
- CVE-2022-24949 Privilege escalation in Eternal Terminal
- CVE-2022-24950 Race condition in Eternal Terminal
- CVE-2022-24951 Race condition in Eternal Terminal
- CVE-2022-24952 Several denial of service vulnerabilities exist in Eternal Terminal prior to version 6.2.0, including a DoS triggered remotely by an invalid
- CVE-2022-48257 Information disclosure in n/a
Sources
Also known as GHSA-m7cp-w3xh-qr3p.