Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/arduino/arduino-create-agent < 1.3.3
Fixed in
1.3.3· Vendor fix available
Issue
Impact The vulnerability affects the endpoint /v2/pkgs/tools/installed and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP POST request. Further details are available in the references. Fixed Version 1.3.3 References The issue was reported by Nozomi Networks Labs. Further details on the issue are available at the following URL: https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide
Recommended action: Upgrade to 1.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/arduino/arduino-create-agent < 1.3.3
Fixed in
1.3.3· Vendor fix available
Issue
Impact The vulnerability affects the endpoint /upload which handles request with the filename parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. Further details are available in the references. Fixed Version 1.3.3 References The issue was reported by Nozomi Networks Labs. Further details are available at the following URL: https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide
Recommended action: Upgrade to 1.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/arduino/arduino-create-agent < 1.3.3
Fixed in
1.3.3· Vendor fix available
Issue
Impact The vulnerability affects the endpoint /v2/pkgs/tools/installed and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP DELETE request. Further details are available in the references. Fixed Version 1.3.3 References The issue was reported by Nozomi Networks Labs. Further details on the issue are available at the following URL: https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide
Recommended action: Upgrade to 1.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/arduino/arduino-create-agent < 1.3.3
Fixed in
1.3.3· Vendor fix available
Issue
Impact The vulnerability affects the endpoint /v2/pkgs/tools/installed. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. Further details are available in the references. Fixed Version 1.3.3 References The issue was reported by Nozomi Networks Labs. Further details are available at the following URL: https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide
Recommended action: Upgrade to 1.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.