CVE-2023-32078

HIGH EPSS 42.4%
Published Aug 24, 20232y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Aug 24, 2023 2y ago
Last Modified Jun 17, 2026 2w ago

Description

Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0.18.6 in the user update function. By specifying another user's username, it was possible to update the other user's password. The issue is patched in 0.17.1 and fixed in 0.18.6. If Users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone using version 0.17.1 can pull the latest docker image of the backend and restart the server.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
42.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-639

Affected Products 2

VendorProductVersionRange
netmakernetmaker* <0.17.1
netmakernetmaker*≥0.18.0  –  ≤0.18.5

References 3

  • github.com https://github.com/gravitl/netmaker/commit/b3be57c65bf0bbfab43b66853c8e3637a43e2839
    Patch
  • github.com https://github.com/gravitl/netmaker/pull/2158
    Patch
  • github.com https://github.com/gravitl/netmaker/security/advisories/GHSA-256m-j5qw-38f4
    Vendor Advisory

Remediation

  • github.com https://github.com/gravitl/netmaker/commit/b3be57c65bf0bbfab43b66853c8e3637a43e2839
    Patch
  • github.com https://github.com/gravitl/netmaker/pull/2158
    Patch