CVE-2023-43091 Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.json
An attacker can execute arbitrary code by providing a malicious service.json configuration file to GNOME Maps.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-43091?
CVE-2023-43091 is a critical code injection vulnerability in gnome:gnome-maps, published on 17 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.
Which versions are affected by CVE-2023-43091?
It affects 1 product.
Products include Gnome Gnome-Maps.
How do I fix CVE-2023-43091?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-43091 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-43091 exists.
Sources
Also known as DEBIAN-CVE-2023-43091, GHSA-8jrf-4f89-74jx, UBUNTU-CVE-2023-43091.