Medium severity · published Sep 13, 2023
CVE-2023-39916
NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optional,…
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for RRDP requests. The location of these stored responses is constructed from the URL of the request. Due to insufficient sanitation of the URL, it is possible for an attacker to craft a URL that results in the response being stored outside of the directory specified for it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RO
Routinator · Nlnetlabs
0.9.0 before 0.12.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-39916
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-39916
Vendor Advisory
https://nlnetlabs.nl/downloads/routinator/CVE-2023-39916.txt
More from Routinator
7.5
CVE-2026-49235
Routinator crashes on specifically crafted RRDP XML files
7.5
CVE-2026-49234
Routinator crashes on specifically crafted ASN strings in the API
7.5
CVE-2026-49233
Routinator cache path traversal using rogue rsync URIs
7.5
CVE-2024-1622
Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after opening
7.5
CVE-2023-39915
NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects