CVE-2023-4570: Improper Restriction in NI MeasurementLink Python Services
First published: Thu Oct 05 2023(Updated: )
### Impact An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node. This affects measurement plug-ins written in Python using version 1.1.0 of the `ni-measurementlink-service` Python package and all previous versions. ### Patches Upgrade all Python measurement plug-ins to use `ni-measurementlink-service` version 1.1.1 or later. ### References Visit [ni.com/info](http://www.ni.com/info) and enter the info code `cve-2023-4570` for more information.
Credit: security@ni.com security@ni.com security@ni.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| NI MeasurementLink | >=1.0.0<1.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/ni/measurementlink-python/security/advisories/GHSA-3f48-9j7q-q2gv
- https://nvd.nist.gov/vuln/detail/CVE-2023-4570
- https://github.com/ni/measurementlink-python/commit/3e9d45147befc9a151fca5582c64fa77c7ba1980
- https://github.com/ni/measurementlink-python/commit/d2c73b1e0252081e1b89767aa916d73772d04dd9
- https://www.ni.com/en/support/documentation/supplemental/23/improper-restriction-in-ni-measurementlink-python-services.html
- https://github.com/advisories/GHSA-3f48-9j7q-q2gv (Advisory)
Frequently Asked Questions
What is the impact of CVE-2023-4570?
An attacker on an adjacent network could reach services exposed on localhost, which were thought to be unreachable outside of the node.
What is the affected software for CVE-2023-4570?
The affected software is ni-measurementlink-service with versions 1.2.0.dev0 up to and including 1.2.0, as well as version 1.1.1.
What is the severity rating of CVE-2023-4570?
The severity rating of CVE-2023-4570 is 8.8 (high).
How can I fix CVE-2023-4570?
To fix CVE-2023-4570, update ni-measurementlink-service to version 1.2.0 or apply the available patch.
Where can I find more information about CVE-2023-4570?
You can find more information about CVE-2023-4570 in the following references: [GitHub Advisory](https://github.com/ni/measurementlink-python/security/advisories/GHSA-3f48-9j7q-q2gv), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-4570), [GitHub Commit](https://github.com/ni/measurementlink-python/commit/3e9d45147befc9a151fca5582c64fa77c7ba1980).
- collector/github-advisory-latest
- alias/GHSA-3f48-9j7q-q2gv
- alias/CVE-2023-4570
- collector/github-advisory
- collector/nvd-api
- collector/nvd-index
- collector/nvd-cve
- agent/type
- agent/references
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/author
- agent/title
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- package-manager/pip
- vendor/ni
- canonical/ni measurementlink
- version/ni measurementlink/1.0.0