PT-2023-30103 · Weborf+1 · Weborf+1

Ltworf · Published 2023-10-25 · Updated 2024-10-11 · CVE-2023-46586

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Weborf versions 0.17 through 0.20 Itworf versions prior to #88

Description The issue is related to a null termination flaw in the cgi.c file of Weborf, where the path for CGI scripts lacks '0' termination due to the misuse of strncpy. This vulnerability could be exploited, posing a risk to users. Users are urged to update to the latest version to mitigate potential threats.

Recommendations For Weborf versions 0.17 through 0.20, update to version 1.0 or later to resolve the issue. For Itworf versions prior to #88, update to the latest version to mitigate risks. As a temporary workaround, consider restricting access to CGI scripts until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2023-46586

Affected Products

Itworf

Weborf

References · 39

• https://osv.dev/vulnerability/CVE-2023-46586 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-46586 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-46586 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46586 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46586 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-46586 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46586 · Vendor Advisory
• https://github.com/ltworf/weborf/commit/49824204add55aab0568d90a6b1e7c822d32120d · Note
• https://github.com/ltworf/weborf/commit/6f83c3e9ceed8b0d93608fd5d42b53c081057991 · Note
• https://github.com/ltworf/weborf/pull/88/commits/7057d254b734dfc9cfb58983f901aa6ec3c94fd4 · Note
• https://github.com/ltworf/weborf/pull/88 · Note
• https://twitter.com/transilienceai/status/1844605822610854191 · Twitter Post
• https://twitter.com/transilienceai/status/1844605801849028816 · Twitter Post
• https://twitter.com/transilienceai/status/1844450511745130517 · Twitter Post
• https://twitter.com/transilienceai/status/1844241522406948865 · Twitter Post