CVE-2023-38317 - Vulnerability Details - OpenCVE

An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the network interface name entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Opennds	Opennds

Configuration 1 [-]

cpe:2.3:a:opennds:opennds:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/openNDS/openNDS/blob/master/ChangeLog
https://github.com/openNDS/openNDS/releases/tag/v10.1.3
https://openwrt.org/docs/guide-user/services/captive-portal/opennds
https://www.forescout.com/resources/sierra21-vulnerabilities

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-01-26T00:00:00

Updated: 2024-08-02T17:39:12.261Z

Reserved: 2023-07-14T00:00:00

Link: CVE-2023-38317

Vulnrichment

No data.

NVD

Status : Modified

Published: 2024-01-26T05:15:11.553

Modified: 2024-11-21T08:13:19.060

Link: CVE-2023-38317

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opennds:opennds:*:*:*:*:*:*:*:*", "matchCriteriaId": "2E74807D-B515-4E44-A5E4-EF82D24F4AE1", "versionEndExcluding": "10.1.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the network interface name entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en OpenNDS antes de 10.1.3. No logra sanitizar la entrada del nombre de la interfaz de red en el archivo de configuraci\u00f3n, lo que permite a los atacantes que tienen acceso directo o indirecto a este archivo ejecutar comandos arbitrarios del sistema operativo."}], "id": "CVE-2023-38317", "lastModified": "2024-11-21T08:13:19.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-26T05:15:11.553", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/openNDS/openNDS/blob/master/ChangeLog"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/openNDS/openNDS/releases/tag/v10.1.3"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://openwrt.org/docs/guide-user/services/captive-portal/opennds"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.forescout.com/resources/sierra21-vulnerabilities"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/openNDS/openNDS/blob/master/ChangeLog"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/openNDS/openNDS/releases/tag/v10.1.3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://openwrt.org/docs/guide-user/services/captive-portal/opennds"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.forescout.com/resources/sierra21-vulnerabilities"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}