CVE-2023-49102
Last modified
CVE-2023-49102 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. NZBGet 21.1 allows authenticated remote code execution because the unarchive programs (7za and unrar) preserve executable file permissions. An attacker with the Control capability can execute a file by setting the value of SevenZipCommand or UnrarCmd. EPSS estimates a 1.50% chance of exploitation in the next 30 days.
Description
NZBGet 21.1 allows authenticated remote code execution because the unarchive programs (7za and unrar) preserve executable file permissions. An attacker with the Control capability can execute a file by setting the value of SevenZipCommand or UnrarCmd. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nzbget | Nzbget | 21.1 |
References
- https://nzbget.net/downloadProduct
- https://sec.maride.cc/posts/nzbget/Exploit, Third Party Advisory
- https://nzbget.net/downloadProduct
- https://sec.maride.cc/posts/nzbget/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-49102?
How severe is CVE-2023-49102?
How do I fix CVE-2023-49102?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-49097ZITADEL is an identity infrastructure system. ZITADEL uses t…8.8
- CVE-2023-49098Discourse-reactions is a plugin that allows user to add thei…3.5
- CVE-2023-49099Discourse is a platform for community discussion. Under very…4.3
- CVE-2023-4910A flaw was found In 3Scale Admin Portal. If a user logs out …5.5
- CVE-2023-49100Trusted Firmware-A (TF-A) before 2.10 has a potential read o…4.4
- CVE-2023-49101WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10…6.1
- CVE-2023-49103An issue was discovered in ownCloud owncloud/graphapi 0.2.x …7.5
- CVE-2023-49104An issue was discovered in ownCloud owncloud/oauth2 before 0…6.1
- CVE-2023-49105An issue was discovered in ownCloud owncloud/core before 10.…9.8
- CVE-2023-49106Missing Password Field Masking vulnerability in Hitachi Devi…7.5
- CVE-2023-49107Generation of Error Message Containing Sensitive Information…7.5
- CVE-2023-49108Path traversal vulnerability exists in RakRak Document Plus …8.8
Are you affected by CVE-2023-49102?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST