Skip to content

Croc may expose secret to local users

Moderate severity GitHub Reviewed Published Sep 20, 2023 to the GitHub Advisory Database • Updated May 21, 2024

Package

gomod github.com/schollz/croc/v9 (Go)

Affected versions

< 9.6.16

Patched versions

9.6.16

Description

An issue was discovered in Croc before 9.6.16. The shared secret, located on a command line, can be read by local users who list all processes and their arguments.

References

Published by the National Vulnerability Database Sep 20, 2023
Published to the GitHub Advisory Database Sep 20, 2023
Reviewed Sep 21, 2023
Last updated May 21, 2024

Severity

Moderate
4.7
/ 10

CVSS base metrics

Attack vector
Local
Attack complexity
High
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses

No CWEs

CVE ID

CVE-2023-43621

GHSA ID

GHSA-7g3v-4ggr-xvjf

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.