CVE-2023-39346 HIGH

CVE-2023-39346: bjrjk/LinuxASMCallGraph before commit 20dba06 allows attackers to cause a RCE on the server side via uploading a crafted ZIP file due to incorrect filtering rules of uploaded file

Vendor Bjrjk

Product LinuxASMCallGraph

Weakness CWE-434 · Unrestricted file upload

Published August 4, 2023

Last update October 17, 2024

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 allows attackers to cause a remote code execution on the server side via uploading a crafted ZIP file due to incorrect filtering rules of uploaded file. The problem has been patched in commit 20dba06bd1a3cf260612d4f21547c25002121cd5. There are no known workarounds.

Key dates

02Disclosure timeline

August 4, 2023 CVE published

October 17, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-39346 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Identifiers

CVE CVE-2023-39346

CWE CWE-434

CVSS 8.8 / HIGH

Affected versions

Vendor Bjrjk

Product LinuxASMCallGraph

Affected < 20dba06bd1a3cf260612d4f21547c25002121cd5