CVE-2023-6899 rmountjoy92 DashMachine Config save_config code injection
Attackers with permissions can execute arbitrary code via the value_template argument in the DashMachine config save handler.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6899?
CVE-2023-6899 is a medium-severity code injection vulnerability in rmountjoy92 DashMachine, published on 17 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability classified as problematic was found in rmountjoy92 DashMachine 0.5-4. Affected by this vulnerability is an unknown functionality of the file /settings/save_config of the component Config Handler. The manipulation of the argument value_template leads to code injection. The exploit has been disclosed to the public and may be used. The identifier VDB-248257 was assigned to this vulnerability.
Weakness: CWE-94
Which versions are affected by CVE-2023-6899?
It affects 1 product.
Products include Rmountjoy92 Dashmachine.
How do I fix CVE-2023-6899?
No fix has been published for CVE-2023-6899 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-6899 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-6899 exists.
Other vulnerabilities in rmountjoy92 DashMachine
Sources
Also known as GHSA-rq72-g3xf-2gx3.