CVSS 3.1 Score 7.0 of 10 (high)


Published Dec 22, 2023
Updated: Jan 3, 2024
CWE ID 367


CVE-2023-43741 is a time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5. This vulnerability allows the buildkite-agent user to bypass a symbolic link check for the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script. It affects a wide range of products, including those with identifiers starting with "t_8fr" and "t_8fp". The vulnerability has a high severity rating, with a base score of 7.0, and poses a potential danger to organizations as it can be exploited locally to gain unauthorized access and compromise the integrity and confidentiality of data. The exploitability score is 1.0, indicating that it is relatively easy to exploit, while the impact score is 5.9, highlighting the significant consequences that can result from successful exploitation.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-43741 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options