CVE-2023-49102: High severity nzbget vulnerability

Published Nov 22, 2023

Updated

NZBGet 21.1 allows authenticated remote code execution because the unarchive programs (7za and unrar) preserve executable file permissions. An attacker with the Control capability can execute a file by setting the value of SevenZipCommand or UnrarCmd. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Affected Software

1 affected component

NZBGet NZBGet=21.1

Event History

Nov 22, 2023

CVE Published

12:00 AM

Data Sourced

12:00 AM

Description

Data Sourced

via NVD·10:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is CVE-2023-49102?

CVE-2023-49102 is a vulnerability in NZBGet version 21.1 that allows authenticated remote code execution.

How does CVE-2023-49102 work?

CVE-2023-49102 allows an attacker with the Control capability to execute a file by setting the value of SevenZipCommand or UnrarCmd.

Which products are affected by CVE-2023-49102?

NZBGet version 21.1 is the only product affected by CVE-2023-49102.

What is the severity of CVE-2023-49102?

CVE-2023-49102 has a severity rating of 8.8 (High).

How can I fix CVE-2023-49102?

To fix CVE-2023-49102, update NZBGet to a version that addresses the vulnerability.