PT-2023-25930 · Pacparser+1 · Pacparser+1

Paul-Gerste-Sonarsource + 1 · Published 2023-06-30 · Updated 2023-07-08 · CVE-2023-37360

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pacparser versions prior to 1.4.2

Description The issue allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL, which may be realistic within enterprise security products.

Recommendations For versions prior to 1.4.2, update to version 1.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the pacparser find proxy function until a patch is available.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2023-37360

GHSA-62Q6-V997-F7V9

PYSEC-2023-93

Affected Products

Debian

Pacparser

References · 11

• 🔥 https://github.com/manugarg/pacparser/security/advisories/GHSA-62q6-v997-f7v9 · Exploit
• https://osv.dev/vulnerability/CVE-2023-37360 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-93 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-37360 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-37360 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-37360 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-37360 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-37360 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-37360 · Security Note
• https://t.me/cvenotify/53913 · Telegram Post
• https://t.me/cibsecurity/65821 · Telegram Post