What is the CVSS score of CVE-2023-39342?

CVE-2023-39342 has a CVSS 3.1 base score of 3.6 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2023-39342?

Yes, a patch is available for CVE-2023-39342. Update the affected software to the latest version immediately.

Dangerzone CVE-2023-39342

LOW

Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)

2023-08-08 security-advisories@github.com

Information Disclosure Microsoft Dangerzone

3.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.6 LOW

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Aug 08, 2023 - 18:15 nvd

LOW 3.6

DescriptionNVD

Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. The Dangerzone CLI (dangerzone-cli command) logs output from the container where the file sanitization takes place, to the user's terminal. Prior to version 0.4.2, if the container is compromised and can return attacker-controlled strings, then the attacker may be able to spoof messages in the user's terminal or change the window title. Besides logging output from containers, it also logs the names of the files it sanitizes. If these files contain ANSI escape sequences, then the same issue applies. Dangerzone is predominantly a GUI application, so this issue should leave most of our users unaffected. Nevertheless, we always suggest updating to the newest version. This issue is fixed in Dangerzone 0.4.2.

AnalysisAI

Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. Rated low severity (CVSS 3.6), this vulnerability is no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-150. Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. The Dangerzone CLI (dangerzone-cli command) logs output from the container where the file sanitization takes place, to the user's terminal. Prior to version 0.4.2, if the container is compromised and can return attacker-controlled strings, then the attacker may be able to spoof messages in the user's terminal or change the window title. Besides logging output from containers, it also logs the names of the files it sanitizes. If these files contain ANSI escape sequences, then the same issue applies. Dangerzone is predominantly a GUI application, so this issue should leave most of our users unaffected. Nevertheless, we always suggest updating to the newest version. This issue is fixed in Dangerzone 0.4.2. Affected products include: Freedom Dangerzone. Version information: version 0.4.2.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.