CVE-2023-5937

Sensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0

Severity Score

5.2

*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

On Windows systems, the Arc configuration files resulted to be world-readable.

This can lead to information disclosure by local attackers, via exfiltration of sensitive data from configuration files.

En los sistemas Windows, los archivos de configuración de Arc resultaron ser legibles en todo el mundo. Esto puede dar lugar a la divulgación de información por parte de atacantes locales, mediante la filtración de datos confidenciales de los archivos de configuración.

*Credits: This issue was found by Diego Giubertoni, Gabriele Quagliarella of Nozomi Networks Security Research team during an internal penetration testing session.

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

Low

User Interaction

None

System

Vulnerable | Subsequent

Confidentiality

Low

High

Integrity

None

High

Availability

None

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-11-02 CVE Reserved
2024-05-15 CVE Published
2024-05-16 EPSS Updated
2024-09-20 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
CWE-732: Incorrect Permission Assignment for Critical Resource

CAPEC

CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels

References (1)

URL	Tag	Source
https://security.nozominetworks.com/NN-2023:15-01

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Nozomi Networks Search vendor "Nozomi Networks"		Arc Search vendor "Nozomi Networks" for product "Arc"				< 1.6.0 Search vendor "Nozomi Networks" for product "Arc" and version " < 1.6.0"		en		Affected