PT-2023-25930 · Pacparser+1 · Pacparser+1

Paul-Gerste-Sonarsource + 1 · Publicado 2023-06-30 · Atualizado 2023-07-08 · CVE-2023-37360

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pacparser versions prior to 1.4.2

Description The issue allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL, which may be realistic within enterprise security products.

Recommendations For versions prior to 1.4.2, update to version 1.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the pacparser find proxy function until a patch is available.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2023-37360

GHSA-62Q6-V997-F7V9

PYSEC-2023-93

Produtos afetados

Debian

Pacparser

Referências · 11

• 🔥 https://github.com/manugarg/pacparser/security/advisories/GHSA-62q6-v997-f7v9 · Exploit
• https://osv.dev/vulnerability/CVE-2023-37360 · Aviso do Fabricante
• https://t.me/cvenotify/53913 · Publicação no Telegram
• https://osv.dev/vulnerability/PYSEC-2023-93 · Aviso do Fabricante
• https://t.me/cibsecurity/65821 · Publicação no Telegram
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-37360 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-37360 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-37360 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-37360 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-37360 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-37360 · Nota de Segurança