Information Disclosure Vulnerability in Croc File Sharing Utility
CVE-2023-43618

5.3MEDIUM

Key Information:

Vendor

Schollz

Status
Croc
Vendor
CVE Published:
20 September 2023

What is CVE-2023-43618?

An information disclosure vulnerability has been identified in the Croc file sharing utility, affecting versions up to 9.6.5. This flaw arises from the protocol's requirement for senders to transmit their local IP addresses in cleartext through an ips? message. As a result, sensitive network information can potentially be intercepted by malicious actors during file transfers, posing a threat to user privacy and network security.

References

https://www.openwall.com/lists/oss-security/2023/09/08/2
https://github.com/schollz/croc/issues/597
http://www.openwall.com/lists/oss-security/2023/09/21/5
mailing-list

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.