PT-2023-22234 · Unknown · Warpinator

Matthias Gerstner · Published 2023-04-27 · Updated 2025-01-13 · CVE-2023-29380

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Warpinator versions prior to 1.6.0

Description The issue allows remote file deletion via directory traversal in top dir basenames. This could enable an attacker to delete arbitrary files on the recipient's computer. The vulnerability has been fixed in Warpinator 1.6.0, which also includes additional protection against similar issues through the use of file system isolation using Landlock or Bubblewrap.

Recommendations For versions prior to 1.6.0, update to Warpinator 1.6.0 to resolve the issue. As a temporary workaround, consider restricting access to the top dir basenames directory to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-29380

Affected Products

Warpinator

References · 7

• 🔥 https://openwall.com/lists/oss-security/2023/04/26/1 · Exploit
• https://github.com/linuxmint/warpinator/compare/1.4.5...1.6.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-29380 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29380 · Vendor Advisory
• https://t.me/cvenotify/107254 · Telegram Post
• https://t.me/opennews/11386 · Telegram Post
• https://t.me/cibsecurity/64755 · Telegram Post