CVE-2023-43800 HIGH

CVE-2023-43800: Insufficient Verification of Data Authenticity in Arduino Create Agent

Vendor Arduino
Product arduino-create-agent
Weakness CWE-345
Published October 18, 2023
Last update September 12, 2024
View on NVD All CVEs

CVSS base score

7.3/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

What the vulnerability does

01Description

Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

October 18, 2023 CVE published
September 12, 2024 Record updated