#VU73834 Input validation error in Flatpak - CVE-2023-28101 

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU73834

#VU73834 Input validation error in Flatpak - CVE-2023-28101

Published: March 20, 2023


Vulnerability identifier: #VU73834
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2023-28101
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Flatpak
Software vendor:
Flatpak

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input when displaying permissions and metadata. A remote attacker can create a specially crafted app that manipulates the appearance of the permissions list through metadata, convincing the user into granting to the app more permissions than agreed by the user.


Remediation

Install updates from vendor's website.

External links