CVE-2023-25344 Code injection in n/a
Attackers can execute arbitrary code in SWIG templates by exploiting a vulnerability in Object.prototype anonymous functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-25344?
CVE-2023-25344 is a critical code injection vulnerability in n/a, published on 15 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to execute arbitrary code via crafted Object.prototype anonymous function.
Weakness: CWE-94
Which versions are affected by CVE-2023-25344?
It affects 2 products.
Products include Swig-Templates Project Swig-Templates, Swig Project Swig.
How do I fix CVE-2023-25344?
No fix has been published for CVE-2023-25344 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-25344 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-25344 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-rjhx-p7x7-qfq6.