CVE-2023-38633: A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the…

Medium severity · published Jul 22, 2023

CVE-2023-38633

A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the…

5.5

CVSS

2.3%

EPSS

On KEV

Description

A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.3% · higher than 83% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Debian Linux · Debian

11.0; 12.0 · source: NVD

Fedora · Fedoraproject

37; 38 · source: NVD

Librsvg · Gnome

2.42.3 before 2.46.6; 2.48.0 before 2.48.11; 2.50.0 before 2.50.8; 2.52.0 before 2.52.10; 2.54.0 before 2.54.6; 2.55.0 before 2.55.3; +1 more · source: NVD

Affected product

Debian Linux

Debian

All Debian Linux CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-38633

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-38633

Mailing List

http://seclists.org/fulldisclosure/2023/Jul/43

Exploit