cvelistv5 - cve-2023-30844

CVE-2023-30844 (GCVE-0-2023-30844)

Vulnerability from cvelistv5 – Published: 2023-05-08 17:54 – Updated: 2025-01-29 15:23

Summary

Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutagen` and prior to version 0.17.1 in `mutagen-compose`, Mutagen `list` and `monitor` commands are susceptible to control characters that could be provided by remote endpoints. This could cause terminal corruption, either intentional or unintentional, if these characters were present in error messages or file paths/names. This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint. On very old systems with terminals susceptible to issues such as CVE-2003-0069, the issue could theoretically cause code execution. The problem has been patched in Mutagen v0.16.6 and v0.17.1. Earlier versions of Mutagen are no longer supported and will not be patched. Versions of Mutagen after v0.18.0 will also have the patch merged. As a workaround, avoiding synchronization of untrusted files or interaction with untrusted remote endpoints should mitigate any risk.

Severity ?

3 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

CWE

CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M

References

URL

Tags

	https://github.com/mutagen-io/mutagen/security/ad…	x_refsource_CONFIRM
	https://github.com/mutagen-io/mutagen/releases/ta…	x_refsource_MISC
	https://github.com/mutagen-io/mutagen/releases/ta…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	mutagen-io	mutagen	Affected: github.com/mutagen-io/mutagen < 0.16.6 Affected: github.com/mutagen-io/mutagen >= 0.17.0, < 0.17.1 Affected: github.com/mutagen-io/mutagen-compose < 0.17.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:37:15.497Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2"
          },
          {
            "name": "https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6"
          },
          {
            "name": "https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-30844",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-29T15:23:36.832965Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-29T15:23:41.754Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mutagen",
          "vendor": "mutagen-io",
          "versions": [
            {
              "status": "affected",
              "version": "github.com/mutagen-io/mutagen \u003c 0.16.6"
            },
            {
              "status": "affected",
              "version": "github.com/mutagen-io/mutagen \u003e= 0.17.0, \u003c 0.17.1"
            },
            {
              "status": "affected",
              "version": "github.com/mutagen-io/mutagen-compose \u003c 0.17.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutagen` and prior to version 0.17.1 in `mutagen-compose`, Mutagen `list` and `monitor` commands are susceptible to control characters that could be provided by remote endpoints.  This could cause terminal corruption, either intentional or unintentional, if these characters were present in error messages or file paths/names. This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint.  On very old systems with terminals susceptible to issues such as CVE-2003-0069, the issue could theoretically cause code execution. The problem has been patched in Mutagen v0.16.6 and v0.17.1.  Earlier versions of Mutagen are no longer supported and will not be patched.  Versions of Mutagen after v0.18.0 will also have the patch merged. As a workaround, avoiding synchronization of untrusted files or interaction with untrusted remote endpoints should mitigate any risk."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-08T17:54:03.685Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2"
        },
        {
          "name": "https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6"
        },
        {
          "name": "https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1"
        }
      ],
      "source": {
        "advisory": "GHSA-jmp2-wc4p-wfh2",
        "discovery": "UNKNOWN"
      },
      "title": "Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-30844",
    "datePublished": "2023-05-08T17:54:03.685Z",
    "dateReserved": "2023-04-18T16:13:15.880Z",
    "dateUpdated": "2025-01-29T15:23:41.754Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mutagen:mutagen:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"0.16.6\", \"matchCriteriaId\": \"0FC7EAD0-2199-4FFD-93B0-31A6CE866C9C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mutagen:mutagen:0.17.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DA304563-83C6-4344-9B53-B46EDC40C9FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mutagen:mutagen_compose:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"0.17.1\", \"matchCriteriaId\": \"F67B41B1-5C50-4FFC-8453-326C21D54AED\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutagen` and prior to version 0.17.1 in `mutagen-compose`, Mutagen `list` and `monitor` commands are susceptible to control characters that could be provided by remote endpoints.  This could cause terminal corruption, either intentional or unintentional, if these characters were present in error messages or file paths/names. This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint.  On very old systems with terminals susceptible to issues such as CVE-2003-0069, the issue could theoretically cause code execution. The problem has been patched in Mutagen v0.16.6 and v0.17.1.  Earlier versions of Mutagen are no longer supported and will not be patched.  Versions of Mutagen after v0.18.0 will also have the patch merged. As a workaround, avoiding synchronization of untrusted files or interaction with untrusted remote endpoints should mitigate any risk.\"}]",
      "id": "CVE-2023-30844",
      "lastModified": "2024-11-21T08:00:57.423",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N\", \"baseScore\": 3.0, \"baseSeverity\": \"LOW\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.3, \"impactScore\": 1.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
      "published": "2023-05-08T18:15:14.280",
      "references": "[{\"url\": \"https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-150\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-116\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-30844\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-05-08T18:15:14.280\",\"lastModified\":\"2024-11-21T08:00:57.423\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutagen` and prior to version 0.17.1 in `mutagen-compose`, Mutagen `list` and `monitor` commands are susceptible to control characters that could be provided by remote endpoints.  This could cause terminal corruption, either intentional or unintentional, if these characters were present in error messages or file paths/names. This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint.  On very old systems with terminals susceptible to issues such as CVE-2003-0069, the issue could theoretically cause code execution. The problem has been patched in Mutagen v0.16.6 and v0.17.1.  Earlier versions of Mutagen are no longer supported and will not be patched.  Versions of Mutagen after v0.18.0 will also have the patch merged. As a workaround, avoiding synchronization of untrusted files or interaction with untrusted remote endpoints should mitigate any risk.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N\",\"baseScore\":3.0,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.3,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-150\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-116\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mutagen:mutagen:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.16.6\",\"matchCriteriaId\":\"0FC7EAD0-2199-4FFD-93B0-31A6CE866C9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mutagen:mutagen:0.17.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA304563-83C6-4344-9B53-B46EDC40C9FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mutagen:mutagen_compose:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.17.1\",\"matchCriteriaId\":\"F67B41B1-5C50-4FFC-8453-326C21D54AED\"}]}]}],\"references\":[{\"url\":\"https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2\", \"name\": \"https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6\", \"name\": \"https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1\", \"name\": \"https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T14:37:15.497Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-30844\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-29T15:23:36.832965Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-29T15:23:05.584Z\"}}], \"cna\": {\"title\": \"Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints\", \"source\": {\"advisory\": \"GHSA-jmp2-wc4p-wfh2\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"mutagen-io\", \"product\": \"mutagen\", \"versions\": [{\"status\": \"affected\", \"version\": \"github.com/mutagen-io/mutagen \u003c 0.16.6\"}, {\"status\": \"affected\", \"version\": \"github.com/mutagen-io/mutagen \u003e= 0.17.0, \u003c 0.17.1\"}, {\"status\": \"affected\", \"version\": \"github.com/mutagen-io/mutagen-compose \u003c 0.17.1\"}]}], \"references\": [{\"url\": \"https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2\", \"name\": \"https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6\", \"name\": \"https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1\", \"name\": \"https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutagen` and prior to version 0.17.1 in `mutagen-compose`, Mutagen `list` and `monitor` commands are susceptible to control characters that could be provided by remote endpoints.  This could cause terminal corruption, either intentional or unintentional, if these characters were present in error messages or file paths/names. This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint.  On very old systems with terminals susceptible to issues such as CVE-2003-0069, the issue could theoretically cause code execution. The problem has been patched in Mutagen v0.16.6 and v0.17.1.  Earlier versions of Mutagen are no longer supported and will not be patched.  Versions of Mutagen after v0.18.0 will also have the patch merged. As a workaround, avoiding synchronization of untrusted files or interaction with untrusted remote endpoints should mitigate any risk.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-150\", \"description\": \"CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-05-08T17:54:03.685Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-30844\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-29T15:23:41.754Z\", \"dateReserved\": \"2023-04-18T16:13:15.880Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2023-05-08T17:54:03.685Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2023-30844

Vulnerability from fkie_nvd - Published: 2023-05-08 18:15 - Updated: 2024-11-21 08:00

Severity ?

3.0 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6	Release Notes
security-advisories@github.com	https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1	Release Notes
security-advisories@github.com	https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2	Vendor Advisory

Impacted products

Vendor	Product	Version
mutagen	mutagen	*
mutagen	mutagen	0.17.0
mutagen	mutagen_compose	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mutagen:mutagen:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0FC7EAD0-2199-4FFD-93B0-31A6CE866C9C",
              "versionEndExcluding": "0.16.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mutagen:mutagen:0.17.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DA304563-83C6-4344-9B53-B46EDC40C9FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mutagen:mutagen_compose:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F67B41B1-5C50-4FFC-8453-326C21D54AED",
              "versionEndExcluding": "0.17.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutagen` and prior to version 0.17.1 in `mutagen-compose`, Mutagen `list` and `monitor` commands are susceptible to control characters that could be provided by remote endpoints.  This could cause terminal corruption, either intentional or unintentional, if these characters were present in error messages or file paths/names. This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint.  On very old systems with terminals susceptible to issues such as CVE-2003-0069, the issue could theoretically cause code execution. The problem has been patched in Mutagen v0.16.6 and v0.17.1.  Earlier versions of Mutagen are no longer supported and will not be patched.  Versions of Mutagen after v0.18.0 will also have the patch merged. As a workaround, avoiding synchronization of untrusted files or interaction with untrusted remote endpoints should mitigate any risk."
    }
  ],
  "id": "CVE-2023-30844",
  "lastModified": "2024-11-21T08:00:57.423",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.0,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-05-08T18:15:14.280",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-150"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-JMP2-WC4P-WFH2

Vulnerability from github – Published: 2023-05-05 02:25 – Updated: 2023-05-05 02:25

Summary

Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints

Details

Impact

Mutagen command line operations, as well as the log output from mutagen daemon run, are susceptible to control characters that could be provided by remote endpoints. This can cause terminal corruption, either intentional or unintentional, if these characters are present in error messages, file paths/names, and/or log output. This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint. On very old systems with terminals susceptible to issues such as CVE-2003-0069, the issue could theoretically cause code execution.

Patches

The problem has been patched in Mutagen v0.16.6 and v0.17.1. Earlier versions of Mutagen are no longer supported and will not be patched. Versions of Mutagen after v0.18.0 will also have the patch merged.

One caveat is that the templating functionality of Mutagen's list and monitor commands has been only partially patched. In particular, the json template function already provided escaping and no patching was necessary. However, raw template output has been left unescaped because this raw output may be necessary for commands which embed Mutagen. To aid these commands, a new shellSanitize template function has been added which provides control character neutralization in strings.

Workarounds

Avoiding synchronization of untrusted files or interaction with untrusted remote endpoints should mitigate any risk.

References

A similar issue can be seen in kubernetes/kubernetes#101695.

Severity ?

3.0 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mutagen-io/mutagen"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.16.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mutagen-io/mutagen-compose"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.17.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mutagen-io/mutagen"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.17.0"
            },
            {
              "fixed": "0.17.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-30844"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-150"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-05T02:25:00Z",
    "nvd_published_at": "2023-05-08T18:15:14Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nMutagen command line operations, as well as the log output from `mutagen daemon run`, are susceptible to control characters that could be provided by remote endpoints.  This can cause terminal corruption, either intentional or unintentional, if these characters are present in error messages, file paths/names, and/or log output.  This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint.  On very old systems with terminals susceptible to issues such as [CVE-2003-0069](https://nvd.nist.gov/vuln/detail/CVE-2003-0069), the issue could theoretically cause code execution.\n\n\n### Patches\n\nThe problem has been patched in Mutagen v0.16.6 and v0.17.1.  Earlier versions of Mutagen are no longer supported and will not be patched.  Versions of Mutagen after v0.18.0 will also have the patch merged.\n\nOne caveat is that the templating functionality of Mutagen\u0027s `list` and `monitor` commands has been only partially patched.  In particular, the `json` template function already provided escaping and no patching was necessary.  However, raw template output has been left unescaped because this raw output may be necessary for commands which embed Mutagen.  To aid these commands, a new `shellSanitize` template function has been added which provides control character neutralization in strings.\n\n\n### Workarounds\n\nAvoiding synchronization of untrusted files or interaction with untrusted remote endpoints should mitigate any risk.\n\n\n### References\n\nA similar issue can be seen in kubernetes/kubernetes#101695.\n",
  "id": "GHSA-jmp2-wc4p-wfh2",
  "modified": "2023-05-05T02:25:00Z",
  "published": "2023-05-05T02:25:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30844"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mutagen-io/mutagen"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints"
}

GSD-2023-30844

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-30844

Aliases

CVE-2023-30844

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-30844",
    "id": "GSD-2023-30844"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-30844"
      ],
      "details": "Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutagen` and prior to version 0.17.1 in `mutagen-compose`, Mutagen `list` and `monitor` commands are susceptible to control characters that could be provided by remote endpoints.  This could cause terminal corruption, either intentional or unintentional, if these characters were present in error messages or file paths/names. This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint.  On very old systems with terminals susceptible to issues such as CVE-2003-0069, the issue could theoretically cause code execution. The problem has been patched in Mutagen v0.16.6 and v0.17.1.  Earlier versions of Mutagen are no longer supported and will not be patched.  Versions of Mutagen after v0.18.0 will also have the patch merged. As a workaround, avoiding synchronization of untrusted files or interaction with untrusted remote endpoints should mitigate any risk.",
      "id": "GSD-2023-30844",
      "modified": "2023-12-13T01:20:52.041544Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2023-30844",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "mutagen",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "github.com/mutagen-io/mutagen \u003c 0.16.6"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "github.com/mutagen-io/mutagen \u003e= 0.17.0, \u003c 0.17.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "github.com/mutagen-io/mutagen-compose \u003c 0.17.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "mutagen-io"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutagen` and prior to version 0.17.1 in `mutagen-compose`, Mutagen `list` and `monitor` commands are susceptible to control characters that could be provided by remote endpoints.  This could cause terminal corruption, either intentional or unintentional, if these characters were present in error messages or file paths/names. This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint.  On very old systems with terminals susceptible to issues such as CVE-2003-0069, the issue could theoretically cause code execution. The problem has been patched in Mutagen v0.16.6 and v0.17.1.  Earlier versions of Mutagen are no longer supported and will not be patched.  Versions of Mutagen after v0.18.0 will also have the patch merged. As a workaround, avoiding synchronization of untrusted files or interaction with untrusted remote endpoints should mitigate any risk."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-150",
                "lang": "eng",
                "value": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2",
            "refsource": "MISC",
            "url": "https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2"
          },
          {
            "name": "https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6",
            "refsource": "MISC",
            "url": "https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6"
          },
          {
            "name": "https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1",
            "refsource": "MISC",
            "url": "https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-jmp2-wc4p-wfh2",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003cv0.17.1",
          "affected_versions": "All versions before 0.17.1",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-116",
            "CWE-937"
          ],
          "date": "2023-05-15",
          "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) in github.com/mutagen-io/mutagen-compose.",
          "fixed_versions": [
            "v0.17.1"
          ],
          "identifier": "CVE-2023-30844",
          "identifiers": [
            "CVE-2023-30844",
            "GHSA-jmp2-wc4p-wfh2"
          ],
          "not_impacted": "All versions starting from 0.17.1",
          "package_slug": "go/github.com/mutagen-io/mutagen-compose",
          "pubdate": "2023-05-08",
          "solution": "Upgrade to version 0.17.1 or above.",
          "title": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "urls": [
            "https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2",
            "https://github.com/advisories/GHSA-jmp2-wc4p-wfh2"
          ],
          "uuid": "892bdf6b-ce97-4514-86d7-0ff3c2b2055c",
          "versions": [
            {
              "commit": {
                "sha": "b588f2a260a039a66efec811d873afc4ad8cc925",
                "tags": [
                  "v0.17.1"
                ],
                "timestamp": "20230504201025"
              },
              "number": "v0.17.1"
            }
          ]
        },
        {
          "affected_range": "\u003cv0.16.6 || \u003e=v0.17.0 \u003cv0.17.1",
          "affected_versions": "All versions before 0.16.6, all versions starting from 0.17.0 before 0.17.1",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-116",
            "CWE-937"
          ],
          "date": "2023-05-15",
          "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) in github.com/mutagen-io/mutagen.",
          "fixed_versions": [
            "v0.16.6",
            "v0.17.1"
          ],
          "identifier": "CVE-2023-30844",
          "identifiers": [
            "CVE-2023-30844",
            "GHSA-jmp2-wc4p-wfh2"
          ],
          "not_impacted": "All versions starting from 0.16.6 before 0.17.0, all versions starting from 0.17.1",
          "package_slug": "go/github.com/mutagen-io/mutagen",
          "pubdate": "2023-05-08",
          "solution": "Upgrade to versions 0.16.6, 0.17.1 or above.",
          "title": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "urls": [
            "https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2",
            "https://github.com/advisories/GHSA-jmp2-wc4p-wfh2"
          ],
          "uuid": "23d4e26a-80de-4dec-b369-225cdac3fa60",
          "versions": [
            {
              "commit": {
                "sha": "2855c81901128b00f7a3fdbd2b9e45bbfd86dab1",
                "tags": [
                  "v0.17.0"
                ],
                "timestamp": "20230221155540"
              },
              "number": "v0.17.0"
            },
            {
              "commit": {
                "sha": "afed45f8e6355f43b78c2ff1b4f26a86a4542645",
                "tags": [
                  "v0.16.6"
                ],
                "timestamp": "20230504185934"
              },
              "number": "v0.16.6"
            }
          ]
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mutagen:mutagen_compose:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.17.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mutagen:mutagen:0.17.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mutagen:mutagen:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.16.6",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2023-30844"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutagen` and prior to version 0.17.1 in `mutagen-compose`, Mutagen `list` and `monitor` commands are susceptible to control characters that could be provided by remote endpoints.  This could cause terminal corruption, either intentional or unintentional, if these characters were present in error messages or file paths/names. This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint.  On very old systems with terminals susceptible to issues such as CVE-2003-0069, the issue could theoretically cause code execution. The problem has been patched in Mutagen v0.16.6 and v0.17.1.  Earlier versions of Mutagen are no longer supported and will not be patched.  Versions of Mutagen after v0.18.0 will also have the patch merged. As a workaround, avoiding synchronization of untrusted files or interaction with untrusted remote endpoints should mitigate any risk."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-116"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6",
              "refsource": "MISC",
              "tags": [
                "Release Notes"
              ],
              "url": "https://github.com/mutagen-io/mutagen/releases/tag/v0.16.6"
            },
            {
              "name": "https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://github.com/mutagen-io/mutagen/security/advisories/GHSA-jmp2-wc4p-wfh2"
            },
            {
              "name": "https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1",
              "refsource": "MISC",
              "tags": [
                "Release Notes"
              ],
              "url": "https://github.com/mutagen-io/mutagen/releases/tag/v0.17.1"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-05-15T18:07Z",
      "publishedDate": "2023-05-08T18:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-30844 (GCVE-0-2023-30844)

FKIE_CVE-2023-30844

GHSA-JMP2-WC4P-WFH2

Impact

Patches

Workarounds

References

GSD-2023-30844

Tags

Sightings

Nomenclature