CVE-2023-32077

HIGH EPSS 86.3%
Published Aug 24, 20232y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Aug 24, 2023 2y ago
Last Modified Jun 17, 2026 2w ago

Description

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6. If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
86.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-321
CWE-798 Use of Hard-coded Credentials Authentication

Affected Products 2

VendorProductVersionRange
netmakernetmaker* <0.17.1
netmakernetmaker*≥0.18.0  –  ≤0.18.5

References 4

  • github.com https://github.com/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51
    Patch
  • github.com https://github.com/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657
    Patch
  • github.com https://github.com/gravitl/netmaker/pull/2170
    Patch
  • github.com https://github.com/gravitl/netmaker/security/advisories/GHSA-8x8h-hcq8-jwwx
    Vendor Advisory

Remediation

  • github.com https://github.com/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51
    Patch
  • github.com https://github.com/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657
    Patch
  • github.com https://github.com/gravitl/netmaker/pull/2170
    Patch