CVE-2023-43801 MEDIUM

CVE-2023-43801: Path traversal in Arduino Create Agent

Vendor Arduino
Product arduino-create-agent
Weakness CWE-22 · Path traversal
Published October 18, 2023
Last update September 12, 2024
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

What the vulnerability does

01Description

Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP DELETE request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

October 18, 2023 CVE published
September 12, 2024 Record updated