Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path traversal in Arduino Create Agent
Vulnerability Description
Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP DELETE request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Vulnerability Title
Arduino 路径遍历漏洞
Vulnerability Description
Arduino是Arduino项目的一款微控制器板。 Arduino Create Agent 1.3.2之前版本存在安全漏洞，该漏洞源于/v2/pkgs/tools/installed端点存在安全漏洞。攻击者可利用该漏洞通过构建的HTTP请求够绕过CORS配置并删除任意文件或文件夹。
CVSS Information
N/A
Vulnerability Type
N/A