Vulnerabilities > CVE-2023-43802 - Unspecified vulnerability in Arduino Create Agent

CVSS 7.8 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

local

low complexity

arduino

NVD

Published: 2023-10-18

Updated: 2024-11-21

Summary

Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/upload` which handles request with the `filename` parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate their privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerable Configurations

Part	Description	Count
Application	Arduino Arduino Create Agent 1.1.60 Arduino Create Agent 1.1.251 Arduino Create Agent 1.1.252 Arduino Create Agent 1.2.0 Arduino Create Agent 1.2.1 Arduino Create Agent 1.2.2 Arduino Create Agent 1.2.3 Arduino Create Agent 1.2.4 Arduino Create Agent 1.2.5 Arduino Create Agent 1.2.6 Arduino Create Agent 1.2.7 Arduino Create Agent 1.3.0 Arduino Create Agent 1.3.1 Arduino Create Agent 1.3.2	32

Summary

Vulnerable Configurations

References