CVE-2023-52076 - Vulnerability Details - OpenCVE

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Mate-desktop	Atril

Configuration 1 [-]

cpe:2.3:a:mate-desktop:atril:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/mate-desktop/atril/commit/e70b21c815418a1e6ebedf6d8d31b8477c03ba50
https://github.com/mate-desktop/atril/releases/tag/v1.26.2
https://github.com/mate-desktop/atril/security/advisories/GHSA-6mf6-mxpc-jc37
https://lists.debian.org/debian-lts-announce/2024/06/msg00003.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-01-25T15:30:12.398Z

Updated: 2025-02-13T17:19:58.399Z

Reserved: 2023-12-26T12:53:20.670Z

Link: CVE-2023-52076

Vulnrichment

No data.

NVD

Status : Modified

Published: 2024-01-25T16:15:07.930

Modified: 2024-11-21T08:39:07.200

Link: CVE-2023-52076

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2023-52076", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-12-26T12:53:20.670Z", "datePublished": "2024-01-25T15:30:12.398Z", "dateUpdated": "2025-02-13T17:19:58.399Z"}, "containers": {"cna": {"title": "Remote Code Execution Vulnerability in Atril's EPUB ebook parsing", "problemTypes": [{"descriptions": [{"cweId": "CWE-24", "lang": "en", "description": "CWE-24: Path Traversal: '../filedir'", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-25", "lang": "en", "description": "CWE-25: Path Traversal: '/../filedir'", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-27", "lang": "en", "description": "CWE-27: Path Traversal: 'dir/../../filename'", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/mate-desktop/atril/security/advisories/GHSA-6mf6-mxpc-jc37", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mate-desktop/atril/security/advisories/GHSA-6mf6-mxpc-jc37"}, {"name": "https://github.com/mate-desktop/atril/commit/e70b21c815418a1e6ebedf6d8d31b8477c03ba50", "tags": ["x_refsource_MISC"], "url": "https://github.com/mate-desktop/atril/commit/e70b21c815418a1e6ebedf6d8d31b8477c03ba50"}, {"name": "https://github.com/mate-desktop/atril/releases/tag/v1.26.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/mate-desktop/atril/releases/tag/v1.26.2"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00003.html"}], "affected": [{"vendor": "mate-desktop", "product": "atril", "versions": [{"version": "< 1.26.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-15T04:06:07.161Z"}, "descriptions": [{"lang": "en", "value": "Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability."}], "source": {"advisory": "GHSA-6mf6-mxpc-jc37", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:48:12.177Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/mate-desktop/atril/security/advisories/GHSA-6mf6-mxpc-jc37", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/mate-desktop/atril/security/advisories/GHSA-6mf6-mxpc-jc37"}, {"name": "https://github.com/mate-desktop/atril/commit/e70b21c815418a1e6ebedf6d8d31b8477c03ba50", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/mate-desktop/atril/commit/e70b21c815418a1e6ebedf6d8d31b8477c03ba50"}, {"name": "https://github.com/mate-desktop/atril/releases/tag/v1.26.2", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/mate-desktop/atril/releases/tag/v1.26.2"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00003.html", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mate-desktop:atril:*:*:*:*:*:*:*:*", "matchCriteriaId": "5535D08A-28B9-4B48-8621-69F5DD6B1F01", "versionEndExcluding": "1.26.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability."}, {"lang": "es", "value": "Atril Document Viewer es el lector de documentos predeterminado del entorno de escritorio MATE para Linux. Existe una vulnerabilidad de path traversal y escritura de archivos arbitrarios en versiones de Atril anteriores a la 1.26.2. Esta vulnerabilidad es capaz de escribir archivos arbitrarios en cualquier parte del sistema de archivos al que tiene acceso el usuario que abre un documento manipulado. La \u00fanica limitaci\u00f3n es que esta vulnerabilidad no se puede aprovechar para sobrescribir archivos existentes, pero eso no impide que un atacante logre la ejecuci\u00f3n remota de comandos en el sistema de destino. La versi\u00f3n 1.26.2 de Atril contiene un parche para esta vulnerabilidad."}], "id": "CVE-2023-52076", "lastModified": "2024-11-21T08:39:07.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-25T16:15:07.930", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mate-desktop/atril/commit/e70b21c815418a1e6ebedf6d8d31b8477c03ba50"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/mate-desktop/atril/releases/tag/v1.26.2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/mate-desktop/atril/security/advisories/GHSA-6mf6-mxpc-jc37"}, {"source": "security-advisories@github.com", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00003.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/mate-desktop/atril/commit/e70b21c815418a1e6ebedf6d8d31b8477c03ba50"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/mate-desktop/atril/releases/tag/v1.26.2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/mate-desktop/atril/security/advisories/GHSA-6mf6-mxpc-jc37"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00003.html"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-24"}, {"lang": "en", "value": "CWE-25"}, {"lang": "en", "value": "CWE-27"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}