Local Information Disclosure in Croc File Sharing Utility
CVE-2023-43621

4.7MEDIUM

Key Information:

Vendor

Schollz

Status
Croc
Vendor
CVE Published:
20 September 2023

What is CVE-2023-43621?

An issue was identified in the Croc file sharing utility impacting version 9.6.5, where a shared secret parameter can be exposed through the command line. This vulnerability allows local users the ability to view sensitive information by listing all processes along with their command line arguments. Such exposure could lead to the unauthorized sharing of secrets and potentially compromise the security of data being transferred.

References

https://www.openwall.com/lists/oss-security/2023/09/08/2
https://github.com/schollz/croc/issues/598
http://www.openwall.com/lists/oss-security/2023/09/21/5
mailing-list

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.