« Volver al listado

CVE-2023-0593

Estado: ModificadaMedia (5.5)—

Una vulnerabilidad de path traversal afecta al extractor del sistema de archivos yaffshiv YAFFS. Al crear un archivo YAFFS malicioso, un atacante podría obligar a yaffshiv a escribir fuera del directorio de extracción. Este problema afecta a yaffshiv hasta la versión 0.1 incluida, que es la más reciente en el momento de la publicación.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Yaffshiv Project — Yaffshiv

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-0593",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-0593",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-27T14:36:51.591264Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "research@onekey.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "research@onekey.com",
      "affectedData": [
        {
          "repo": "https://github.com/devttys0/yaffshiv",
          "vendor": "devttys0",
          "modules": [
            "yaffshiv"
          ],
          "product": "yaffshiv",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "0.1",
              "lessThanOrEqual": "0.1"
            }
          ],
          "packageName": "yaffshiv",
          "collectionURL": "https://github.com/devttys0/yaffshiv",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-01-31T10:15:10.450",
  "references": [
    {
      "url": "https://github.com/devttys0/yaffshiv/pull/3/files",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "research@onekey.com"
    },
    {
      "url": "https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "research@onekey.com"
    },
    {
      "url": "https://github.com/devttys0/yaffshiv/pull/3/files",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "research@onekey.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A path traversal vulnerability affects yaffshiv YAFFS filesystem extractor. By crafting a malicious YAFFS file, an attacker could force yaffshiv to write outside of the extraction directory.\n\nThis issue affects yaffshiv up to version 0.1 included, which is the most recent at time of publication.\n\n"
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de path traversal afecta al extractor del sistema de archivos yaffshiv YAFFS. Al crear un archivo YAFFS malicioso, un atacante podría obligar a yaffshiv a escribir fuera del directorio de extracción. Este problema afecta a yaffshiv hasta la versión 0.1 incluida, que es la más reciente en el momento de la publicación."
    }
  ],
  "lastModified": "2026-06-17T05:25:53.423",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yaffshiv_project:yaffshiv:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2021F4D-2F0D-4215-9645-AAE41EE63D76",
              "versionEndIncluding": "0.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "research@onekey.com"
}