CVE-2023-43802: high-severity vulnerability in arduino-create-agent
Path traversal in Arduino Create Agent
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.4%
Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/upload` which handles request with the `filename` parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate their privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
arduino · arduino-create-agentRelated CVEs — arduino-create-agent
In the same product, most dangerous first.
CVE-2023-43801MEDIUMPath traversal in Arduino Create AgentEPSS 0.3%CVE-2023-43803MEDIUMPath traversal in Arduino Create AgentEPSS 0.3%CVE-2023-49296MEDIUMArduino Create Agent vulnerable to Reflected Cross-Site ScriptingEPSS 0.3%CVE-2023-43800HIGHInsufficient Verification of Data Authenticity in Arduino Create AgentEPSS 0.2%