CVE-2023-37378 - OpenCVE

Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Nullsoft	Nullsoft Scriptable Install System

Configuration 1 [-]

cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://sf.net/p/nsis/bugs/1296
https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967
https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467
https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0
https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html
https://lists.debian.org/debian-lts-announce/2024/09/msg00013.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM/
https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09
https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/

History

Thu, 05 Sep 2024 15:30:00 +0000

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2024/09/msg00013.html

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-07-03T00:00:00

Updated: 2024-09-05T14:51:02.310Z

Reserved: 2023-07-03T00:00:00

Link: CVE-2023-37378

Vulnrichment

Updated: 2024-09-05T00:09:22.793Z

NVD

Status : Modified

Published: 2023-07-03T20:15:09.620

Modified: 2023-11-07T04:16:54.580

Link: CVE-2023-37378

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-37378", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-09-05T14:51:02.310Z", "dateReserved": "2023-07-03T00:00:00", "datePublished": "2023-07-03T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-07-13T00:00:00"}, "descriptions": [{"lang": "en", "value": "Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "http://sf.net/p/nsis/bugs/1296"}, {"url": "https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09"}, {"url": "https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/"}, {"url": "https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967"}, {"url": "https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467"}, {"url": "https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0"}, {"name": "[debian-lts-announce] 20230707 [SECURITY] [DLA 3483-1] nsis security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html"}, {"name": "FEDORA-2023-dfb6cc599f", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM/"}, {"name": "FEDORA-2023-b9ec99605f", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://sf.net/p/nsis/bugs/1296", "tags": ["x_transferred"]}, {"url": "https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09", "tags": ["x_transferred"]}, {"url": "https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/", "tags": ["x_transferred"]}, {"url": "https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967", "tags": ["x_transferred"]}, {"url": "https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467", "tags": ["x_transferred"]}, {"url": "https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0", "tags": ["x_transferred"]}, {"name": "[debian-lts-announce] 20230707 [SECURITY] [DLA 3483-1] nsis security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html"}, {"name": "FEDORA-2023-dfb6cc599f", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM/"}, {"name": "FEDORA-2023-b9ec99605f", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK/"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00013.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-09-05T00:09:22.793Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-05T14:50:49.808091Z", "id": "CVE-2023-37378", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-05T14:51:02.310Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://sf.net/p/nsis/bugs/1296", "tags": ["x_transferred"]}, {"url": "https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09", "tags": ["x_transferred"]}, {"url": "https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/", "tags": ["x_transferred"]}, {"url": "https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967", "tags": ["x_transferred"]}, {"url": "https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467", "tags": ["x_transferred"]}, {"url": "https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html", "name": "[debian-lts-announce] 20230707 [SECURITY] [DLA 3483-1] nsis security update", "tags": ["mailing-list", "x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM/", "name": "FEDORA-2023-dfb6cc599f", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK/", "name": "FEDORA-2023-b9ec99605f", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00013.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-09-05T00:09:22.793Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-37378", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-05T14:50:49.808091Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-05T14:50:57.697Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "http://sf.net/p/nsis/bugs/1296"}, {"url": "https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09"}, {"url": "https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/"}, {"url": "https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967"}, {"url": "https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467"}, {"url": "https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html", "name": "[debian-lts-announce] 20230707 [SECURITY] [DLA 3483-1] nsis security update", "tags": ["mailing-list"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM/", "name": "FEDORA-2023-dfb6cc599f", "tags": ["vendor-advisory"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK/", "name": "FEDORA-2023-b9ec99605f", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-07-13T00:00:00"}}}, "cveMetadata": {"cveId": "CVE-2023-37378", "state": "PUBLISHED", "dateUpdated": "2024-09-05T14:51:02.310Z", "dateReserved": "2023-07-03T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-07-03T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "18F35A89-2710-4212-8C1C-1333A64EBDAA", "versionEndIncluding": "3.09", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory."}], "id": "CVE-2023-37378", "lastModified": "2023-11-07T04:16:54.580", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-07-03T20:15:09.620", "references": [{"source": "cve@mitre.org", "tags": ["Issue Tracking", "Permissions Required"], "url": "http://sf.net/p/nsis/bugs/1296"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK/"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM/"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}