by Kastro
Paper/Archive/CVE-2023-43091

CVE-2023-43091

gnome_maps gnome_maps — Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.json

EPSS 1.0%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 62.2.622 × 2012.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.

Affected

ProductAffectedFixed inSource
gnome-maps43.0 – 45.beta–CNA
gnome_maps43.0 – 45_beta–CISA-ADP

Scores by source

fedora (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refbugzilla.redhat.com/show_bug.cgi?id=2239091refgitlab.gnome.org/GNOME/gnome-maps/-/commit/d26cd774d524404ef7784e6808f551de83de4bearefgitlab.gnome.org/GNOME/gnome-maps/-/issues/588