Data Exposure in Croc File Sharing Utility by Schollz
CVE-2023-43617

5.3MEDIUM

Key Information:

Vendor

Schollz

Status
Croc
Vendor
CVE Published:
20 September 2023

What is CVE-2023-43617?

A vulnerability has been identified in the Croc file-sharing utility version 9.6.5 and earlier. This issue arises when a custom shared secret is employed, resulting in the potential exposure of significant portions of this secret to an untrusted relay. As the sender and receiver work to compose a room name, sensitive information may inadvertently be shared, posing a risk to data confidentiality and integrity.

References

https://www.openwall.com/lists/oss-security/2023/09/08/2
https://github.com/schollz/croc/issues/596
http://www.openwall.com/lists/oss-security/2023/09/21/5
mailing-list

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.