Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Insufficient Verification of Data Authenticity in Arduino Create Agent
Vulnerability Description
Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Vulnerability Type
对数据真实性的验证不充分
Vulnerability Title
Arduino 数据伪造问题漏洞
Vulnerability Description
Arduino是Arduino项目的一款微控制器板。 Arduino Create Agent 1.3.2之前版本存在安全漏洞，该漏洞源于/v2/pkgs/tools/installed端点存在安全漏洞。攻击者可利用该漏洞通过构建的HTTP POST请求够绕过CORS配置并提升权限。
CVSS Information
N/A
Vulnerability Type
N/A