CVE-2023-28371 Path traversal in n/a
Attackers can write to unintended files using absolute paths or directory traversal in Stellarium, potentially modifying system files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-28371?
CVE-2023-28371 is a critical path traversal vulnerability in n/a, published on 15 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal.
Weakness: CWE-22
Which versions are affected by CVE-2023-28371?
It affects 1 product.
Linux distribution packages (3)
stellarium SUSE:Package Hub 15 SP4 | All versions | 0.21.2-bp154.2.3.1 |
stellarium openSUSE:Leap 15.4 | All versions | 0.21.2-bp154.2.3.1 |
stellarium openSUSE:Tumbleweed | All versions | 23.1-1.1 |
Products include Stellarium Stellarium.
How do I fix CVE-2023-28371?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-28371 being exploited?
There is no known exploitation of CVE-2023-28371 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2023-28371, GHSA-7vmm-m8vp-g5h3, MGASA-2023-0129, UBUNTU-CVE-2023-28371, openSUSE-SU-2023:0097-1, openSUSE-SU-2024:12819-1.