CVE-2023-43800highCWE-345

CVE-2023-43800: high-severity vulnerability in arduino-create-agent

Insufficient Verification of Data Authenticity in Arduino Create Agent

Published · Updated

Follow this CVE+ Monitor arduino-create-agent+ Monitor github.com/arduino/arduino-create-agent

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3epss 0.2%
Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Affected products
arduino · arduino-create-agent
Related CVEs — arduino-create-agent

In the same product, most dangerous first.

CVE-2023-43802HIGHPath traversal in Arduino Create AgentEPSS 0.4%CVE-2023-43801MEDIUMPath traversal in Arduino Create AgentEPSS 0.3%CVE-2023-43803MEDIUMPath traversal in Arduino Create AgentEPSS 0.3%CVE-2023-49296MEDIUMArduino Create Agent vulnerable to Reflected Cross-Site ScriptingEPSS 0.3%