« Volver al listado

CVE-2023-45284

Estado: ModificadaMedia (5.3)—

On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Golang — GO

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-45284",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-45284",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-03T18:55:41.107810Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@golang.org",
      "affectedData": [
        {
          "vendor": "Go standard library",
          "product": "path/filepath",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.20.11",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.21.0-0",
              "lessThan": "1.21.4",
              "versionType": "semver"
            }
          ],
          "packageName": "path/filepath",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "IsLocal"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"
          ],
          "vendor": "golang",
          "product": "go",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.20.11",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.21.0-0",
              "lessThan": "1.21.4",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-11-09T17:15:08.813",
  "references": [
    {
      "url": "https://go.dev/cl/540277",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://go.dev/issue/63713",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY",
      "tags": [
        "Issue Tracking",
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2023-2186",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://go.dev/cl/540277",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://go.dev/issue/63713",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY",
      "tags": [
        "Issue Tracking",
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2023-2186",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as \"COM1 \", and reserved names \"COM\" and \"LPT\" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local."
    },
    {
      "lang": "es",
      "value": "En Windows, la función IsLocal no detecta correctamente los nombres de dispositivos reservados en algunos casos. Los nombres reservados seguidos de espacios, como \"COM1\", y los nombres reservados \"COM\" y \"LPT\" seguidos del superíndice 1, 2 o 3 se informan incorrectamente como locales. Con la solución, IsLocal ahora informa correctamente estos nombres como no locales."
    }
  ],
  "lastModified": "2026-06-17T06:28:35.010",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1E7C289-7484-4AA8-A96B-07D2E2933258",
              "versionEndExcluding": "1.20.11"
            },
            {
              "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E3FC16C-41B2-4900-901F-48BDA3DC9ED2",
              "versionEndExcluding": "1.21.4",
              "versionStartIncluding": "1.21.0-0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@golang.org"
}