CVE-2023-42183

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-42183
lockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrictions, such as when U+1FEF is converted to a backtick.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/lockss/lockss-daemon/security/advisories/GHSA-mgqj-hphf-9588 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:lockss:classic_lockss_daemon:*:*:*:*:*:*:*:*
History

28 Dec 2023, 18:11

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
References () https://github.com/lockss/lockss-daemon/security/advisories/GHSA-mgqj-hphf-9588 - () https://github.com/lockss/lockss-daemon/security/advisories/GHSA-mgqj-hphf-9588 - Exploit, Vendor Advisory
CWE CWE-116
CPE cpe:2.3:a:lockss:classic_lockss_daemon:*:*:*:*:*:*:*:*
First Time Lockss
Lockss classic Lockss Daemon

15 Dec 2023, 13:42

Type Values Removed Values Added
Summary
  • (es) lockss-daemon (también conocido como Classic LOCKSS Daemon) anterior a 1.77.3 realiza una normalización posterior a Unicode, lo que puede permitir eludir las restricciones de acceso previstas, como cuando U+1FEF se convierte en una comilla invertida.

15 Dec 2023, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-15 01:15

Updated : 2023-12-28 18:11

NVD link : CVE-2023-42183

Mitre link : CVE-2023-42183

CVE.ORG link : CVE-2023-42183

JSON object : View

Products Affected

lockss

  • classic_lockss_daemon
CWE
CWE-116

Improper Encoding or Escaping of Output