PT-2023-8937 · Outdoorbits · Little-Backup-Box

CVE-2023-52262 · Publicado 2023-12-30 · Atualizado 2024-01-09

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions outdoorbits little-backup-box versions prior to f39f91c

Description The issue allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input. This is due to insufficient validation of input data.

Recommendations For versions prior to f39f91c, update to a version after f39f91c to resolve the issue. As a temporary workaround, consider disabling the use of the PHP extract function for untrusted input until a patch is available. Restrict access to the affected software to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

BDU:2024-02733

CVE-2023-52262

Produtos afetados

Little-Backup-Box

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52262.json · Exploit
• https://github.com/outdoorbits/little-backup-box/commit/f39f91cd05544b3eb18b59897c765d6ba9313faa · Correção
• https://github.com/advisories/GHSA-rq2j-cfp8-w8c7 · Nota
• https://vuldb.com/de/?id.249396 · Nota
• https://t.me/cibsecurity/74043 · Publicação no Telegram
• https://twitter.com/Esparta6108713/status/1741502110573961571 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1741170371598954860 · Publicação no Twitter
• https://php.net/manual/ru/function.extract.php · Nota
• https://t.me/cvenotify/65813 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2024-02733 · Nota de Segurança
• https://php.net/manual/en/function.extract · Nota
• https://osv.dev/vulnerability/CVE-2023-52262 · Aviso do Fabricante
• https://t.me/cvenotify/66827 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-52262 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1741209619383333302 · Publicação no Twitter