漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Insufficient Verification of Data Authenticity in Arduino Create Agent
Vulnerability Description
Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Vulnerability Type
对数据真实性的验证不充分
Vulnerability Title
Arduino 数据伪造问题漏洞
Vulnerability Description
Arduino是Arduino项目的一款微控制器板。 Arduino Create Agent 1.3.2之前版本存在安全漏洞，该漏洞源于/v2/pkgs/tools/installed端点存在安全漏洞。攻击者可利用该漏洞通过构建的HTTP POST请求够绕过CORS配置并提升权限。
CVSS Information
N/A
Vulnerability Type
N/A