Local Users Could Access Sensitive Application Data Due to Insufficient Permissions in Apache Portable Runtime on Unix Platforms
CVE-2023-49582

5.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Portable Runtime (apr)
Vendor
CVE Published:
26 August 2024

What is CVE-2023-49582?

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.

This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h)

Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.

Affected Version(s)

Apache Portable Runtime (APR) 0.9.0 <= 1.7.4

References

https://lists.apache.org/thread/sntjc04t1rvjhdzz2tzmtz2zd...
vendor-advisory

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thomas Stangner
.
CVE-2023-49582 : Local Users Could Access Sensitive Application Data Due to Insufficient Permissions in Apache Portable Runtime on Unix Platforms