Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2023-43091

Summary
Assigner-fedora
Assigner Org ID-92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5
Published At-17 Nov, 2024 | 12:25
Updated At-18 Nov, 2024 | 16:39
Rejected At-
Credits

Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.json

A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:fedora
Assigner Org ID:92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5
Published At:17 Nov, 2024 | 12:25
Updated At:18 Nov, 2024 | 16:39
Rejected At:
▼CVE Numbering Authority (CNA)
Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.json

A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.

Affected Products
Collection URL
https://gitlab.gnome.org/GNOME/gnome-maps
Package Name
gnome-maps
Default Status
unaffected
Versions
Affected
  • From 43.0 through 45.beta (custom)
Problem Types
TypeCWE IDDescription
CWECWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Type: CWE
CWE ID: CWE-79
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Metrics
VersionBase scoreBase severityVector
3.19.8CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Version: 3.1
Base score: 9.8
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Red Hat severity rating
value:
Moderate
namespace:
https://access.redhat.com/security/updates/classification/
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Red Hat would like to thank Michael Evans for reporting this issue.
Timeline
EventDate
Reported to Red Hat.2023-09-15 00:00:00
Made public.2023-09-15 00:00:00
Event: Reported to Red Hat.
Date: 2023-09-15 00:00:00
Event: Made public.
Date: 2023-09-15 00:00:00
Replaced By
Rejected Reason
References
HyperlinkResource
https://bugzilla.redhat.com/show_bug.cgi?id=2239091
issue-tracking
x_refsource_REDHAT
https://gitlab.gnome.org/GNOME/gnome-maps/-/commit/d26cd774d524404ef7784e6808f551de83de4bea
N/A
https://gitlab.gnome.org/GNOME/gnome-maps/-/issues/588
N/A
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2239091
Resource:
issue-tracking
x_refsource_REDHAT
Hyperlink: https://gitlab.gnome.org/GNOME/gnome-maps/-/commit/d26cd774d524404ef7784e6808f551de83de4bea
Resource: N/A
Hyperlink: https://gitlab.gnome.org/GNOME/gnome-maps/-/issues/588
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Vendor
gnome_maps
Product
gnome_maps
CPEs
  • cpe:2.3:a:gnome_maps:gnome_maps:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 43.0 through 45_beta (custom)
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:patrick@puiterwijk.org
Published At:17 Nov, 2024 | 13:15
Updated At:06 Aug, 2025 | 12:46

A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.19.8CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 9.8
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE Matches
The GNOME Project
gnome
>>gnome-maps>>Versions from 43.0(inclusive) to 43.7(exclusive)
cpe:2.3:a:gnome:gnome-maps:*:*:*:*:*:*:*:*
The GNOME Project
gnome
>>gnome-maps>>Versions from 44.0(inclusive) to 44.4(exclusive)
cpe:2.3:a:gnome:gnome-maps:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-79Secondarypatrick@puiterwijk.org
CWE-94Primarynvd@nist.gov
CWE ID: CWE-79
Type: Secondary
Source: patrick@puiterwijk.org
CWE ID: CWE-94
Type: Primary
Source: nvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://bugzilla.redhat.com/show_bug.cgi?id=2239091patrick@puiterwijk.org
Issue Tracking
Third Party Advisory
https://gitlab.gnome.org/GNOME/gnome-maps/-/commit/d26cd774d524404ef7784e6808f551de83de4beapatrick@puiterwijk.org
Patch
https://gitlab.gnome.org/GNOME/gnome-maps/-/issues/588patrick@puiterwijk.org
Exploit
Issue Tracking
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2239091
Source: patrick@puiterwijk.org
Resource:
Issue Tracking
Third Party Advisory
Hyperlink: https://gitlab.gnome.org/GNOME/gnome-maps/-/commit/d26cd774d524404ef7784e6808f551de83de4bea
Source: patrick@puiterwijk.org
Resource:
Patch
Hyperlink: https://gitlab.gnome.org/GNOME/gnome-maps/-/issues/588
Source: patrick@puiterwijk.org
Resource:
Exploit
Issue Tracking

Change History

0
Information is not available yet

Similar CVEs

0Records found
Details not found