CVE-2023-45283

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Nov 9, 2023
Updated: Dec 14, 2023
CWE ID 22

Summary

CVE-2023-45283 is a vulnerability that affects the filepath package in Go. It specifically impacts paths with a ??\ prefix on Windows, which are equivalent to paths beginning with \?. These paths can be used to access arbitrary locations on the system. Before the fix, functions like Clean and Join could convert rooted paths containing \a..??\b into the root local device path ??\b. However, after the fix, Clean converts this to .??\b and Join converts it to .??\b. The vulnerability has a high base severity rating of 7.5 out of 10 and poses a confidentiality impact risk as it allows unauthorized access to sensitive system locations. To remediate this vulnerability, organizations should update their Go installations to versions 1.20.11 or 1.21.4 or later.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-45283 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options