CVE-2023-46122

2023-10-2316:15:09

CWE-22

GitHub_M

web.nvd.nist.gov

sbt

build tool

scala

java

cve-2023-46122

security vulnerability

file writing

unauthorized access

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

13.2%

JSON

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. This would have potential to overwrite /root/.ssh/authorized_keys. Within sbt’s main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however many projects use IO.unzip(...) directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.

Affected configurations

Nvd

Vulners

Node

scala-sbtioRange1.0.0–1.9.7sbt

scala-sbtsbtRange0.3.4–1.9.7

VendorProductVersionCPE
scala-sbtio*cpe:2.3:a:scala-sbt:io:*:*:*:*:*:sbt:*:*
scala-sbtsbt*cpe:2.3:a:scala-sbt:sbt:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
scala-sbt	io	*	cpe:2.3:a:scala-sbt:io::::::sbt::*
scala-sbt	sbt	*	cpe:2.3:a:scala-sbt:sbt::::::::

CNA Affected

[
  {
    "vendor": "sbt",
    "product": "sbt",
    "versions": [
      {
        "version": ">= 0.3.4, < 1.9.7",
        "status": "affected"
      }
    ]
  }
]