CVE-2023-5937 LOW

CVE-2023-5937: Sensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0

Vendor Nozomi Networks
Product Arc
Weakness CWE-538
Published May 15, 2024
Last update September 20, 2024
View on NVD All CVEs

CVSS base score

3.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

On Windows systems, the Arc configuration files resulted to be world-readable. This can lead to information disclosure by local attackers, via exfiltration of sensitive data from configuration files.

Key dates

02Disclosure timeline

May 15, 2024 CVE published
September 20, 2024 Record updated