File Overwrite Vulnerability in Croc by Schollz
CVE-2023-43616

5.5MEDIUM

Key Information:

Vendor

Schollz

Status
Croc
Vendor
CVE Published:
20 September 2023

What is CVE-2023-43616?

A vulnerability in the Croc file sharing utility allows an attacker to create a specially crafted ZIP file that, when extracted by the receiver, can overwrite files unintentionally. This risk affects Croc versions up to 9.6.5 and can compromise data integrity during file transfers. Users are advised to update their installations and handle ZIP files with caution to mitigate potential risks.

References

https://www.openwall.com/lists/oss-security/2023/09/08/2
https://github.com/schollz/croc/issues/594
http://www.openwall.com/lists/oss-security/2023/09/21/5
mailing-list

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.