« Volver al listado

CVE-2023-43091

Estado: AnalizadaCrítica (9.8)—

A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentPrivileged Account ManagementExecution PreventionBehavior Prevention on EndpointDisable or Remove Feature or ProgramVulnerability Scanning

Tecnologías afectadas (1)

Gnome — Gnome-maps

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-43091",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-43091",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-18T16:37:11.571593Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "patrick@puiterwijk.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "patrick@puiterwijk.org",
      "affectedData": [
        {
          "versions": [
            {
              "status": "affected",
              "version": "43.0",
              "versionType": "custom",
              "lessThanOrEqual": "45.beta"
            }
          ],
          "packageName": "gnome-maps",
          "collectionURL": "https://gitlab.gnome.org/GNOME/gnome-maps",
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:gnome_maps:gnome_maps:*:*:*:*:*:*:*:*"
          ],
          "vendor": "gnome_maps",
          "product": "gnome_maps",
          "versions": [
            {
              "status": "affected",
              "version": "43.0",
              "versionType": "custom",
              "lessThanOrEqual": "45_beta"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-17T13:15:14.140",
  "references": [
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2239091",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "patrick@puiterwijk.org"
    },
    {
      "url": "https://gitlab.gnome.org/GNOME/gnome-maps/-/commit/d26cd774d524404ef7784e6808f551de83de4bea",
      "tags": [
        "Patch"
      ],
      "source": "patrick@puiterwijk.org"
    },
    {
      "url": "https://gitlab.gnome.org/GNOME/gnome-maps/-/issues/588",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "source": "patrick@puiterwijk.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "patrick@puiterwijk.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en GNOME Maps, que es vulnerable a un ataque de inyección de código a través de su archivo de configuración service.json. Si el archivo de configuración es malicioso, puede ejecutar código arbitrario."
    }
  ],
  "lastModified": "2026-06-17T06:25:06.707",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gnome:gnome-maps:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5506EB68-F04D-4CB7-9F2D-13E10CB31BCA",
              "versionEndExcluding": "43.7",
              "versionStartIncluding": "43.0"
            },
            {
              "criteria": "cpe:2.3:a:gnome:gnome-maps:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39202FA1-1184-4C4C-AFDF-7E11260D7573",
              "versionEndExcluding": "44.4",
              "versionStartIncluding": "44.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "patrick@puiterwijk.org"
}