Terminal Device Vulnerability in Croc File Sharing Utility by Schollz
CVE-2023-43620

7.8HIGH

Key Information:

Vendor

Schollz

Status
Croc
Vendor
CVE Published:
20 September 2023

What is CVE-2023-43620?

A security vulnerability has been identified in the Croc file sharing utility up to version 9.6.5, where an attacker can exploit the system by embedding ANSI or CSI escape sequences within a filename. This manipulation can lead to unexpected behavior in the terminal of the receiving device, potentially compromising the integrity and security of the user's environment. Users are advised to update to the latest version and implement security best practices to mitigate potential risks associated with this vulnerability.

References

https://www.openwall.com/lists/oss-security/2023/09/08/2
https://github.com/schollz/croc/issues/595
http://www.openwall.com/lists/oss-security/2023/09/21/5
mailing-list

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.