Log in Start free

Vulnerability · Published Mar 24, 2023 · Assigned by mitre

CVE-2023-28686

Medium 5.3

In plain English

A medium-severity authorization bypass via user-controlled key in the dino package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.7%top 46.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20dino0.4.2-r0ALPINE-CVE-2023-28686
Alpine:v3.21dino0.4.2-r0ALPINE-CVE-2023-28686
Alpine:v3.22dino0.4.2-r0ALPINE-CVE-2023-28686
Alpine:v3.23dino0.4.2-r0ALPINE-CVE-2023-28686
Alpine:v3.24dino0.4.2-r0ALPINE-CVE-2023-28686
Debian:12dino-im0.4.2-1DEBIAN-CVE-2023-28686
Debian:13dino-im0.4.2-1DEBIAN-CVE-2023-28686
Debian:14dino-im0.4.2-1DEBIAN-CVE-2023-28686

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References