CVE-2023-43803mediumCWE-22

CVE-2023-43803: medium-severity vulnerability in arduino-create-agent

Path traversal in Arduino Create Agent

Published · Updated

Follow this CVE+ Monitor arduino-create-agent+ Monitor github.com/arduino/arduino-create-agent

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.3%
Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Affected products
arduino · arduino-create-agent
Related CVEs — arduino-create-agent

In the same product, most dangerous first.

CVE-2023-43802HIGHPath traversal in Arduino Create AgentEPSS 0.4%CVE-2023-43801MEDIUMPath traversal in Arduino Create AgentEPSS 0.3%CVE-2023-49296MEDIUMArduino Create Agent vulnerable to Reflected Cross-Site ScriptingEPSS 0.3%CVE-2023-43800HIGHInsufficient Verification of Data Authenticity in Arduino Create AgentEPSS 0.2%