CVE-2023-23558 — MEDIUM (6.3)

Vulnerability Description

In Eternal Terminal 6.2.1, TelemetryService uses fixed paths in /tmp. For example, a local attacker can create /tmp/.sentry-native-etserver with mode 0777 before the etserver process is started. The attacker can choose to read sensitive information from that file, or modify the information in that file.

CVSS Score

6.3

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Eternal Terminal Project	Eternal Terminal	6.2.1

Related Weaknesses (CWE)

CWE-59

References

http://www.openwall.com/lists/oss-security/2023/02/16/1Mailing ListPatchThird Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1207126ExploitIssue TrackingThird Party Advisory
https://github.com/MisterTea/EternalTerminalProduct
http://www.openwall.com/lists/oss-security/2023/02/16/1Mailing ListPatchThird Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1207126ExploitIssue TrackingThird Party Advisory
https://github.com/MisterTea/EternalTerminalProduct

FAQ

What is CVE-2023-23558?

CVE-2023-23558 is a vulnerability with a CVSS score of 6.3 (MEDIUM). In Eternal Terminal 6.2.1, TelemetryService uses fixed paths in /tmp. For example, a local attacker can create /tmp/.sentry-native-etserver with mode 0777 before the etserver process is started. The a...

How severe is CVE-2023-23558?

CVE-2023-23558 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-23558?

Check the references section above for vendor advisories and patch information. Affected products include: Eternal Terminal Project Eternal Terminal.