CVE-2023-38346

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Sep 22, 2023
Updated: Sep 26, 2023
CWE ID 22

Summary

CVE-2023-38346 is a vulnerability in Wind River VxWorks 6.9 and 7 that affects the "tarExtract" function used for TAR file extraction. The issue arises when processing files within an archive that have relative or absolute file paths. It is expected that the function should strip leading slashes from absolute paths or stop processing when encountering relative paths outside of the extraction path, unless forced. However, this vulnerability could result in unexpected behavior and directory traversal, posing a potential danger to organizations. The vulnerability has a base severity rating of HIGH and can be exploited over the network with low privileges required. It has a CVSS v3.1 score of 8.8, with high impacts on integrity and confidentiality. Remediation steps are not provided in the information given.

Leverage our Vulnerability Intelligence module to secure your systems now - get detailed insights on CVE-2024-37364. Book your demo today.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-38346 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options