Exposure of Sensitive Information to an Unauthorized Actor
CVE-2023-40023
Summary
yaklang is a programming language designed for cybersecurity. The github.com/yaklang/yaklang has been found to contain a local file inclusion (LFI) vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to the unintended exposure of sensitive data, potential remote code execution, or other security breaches. Users utilizing versions of the Yak Engine prior to 1.2.4-sp2 are impacted. Users are advised to upgrade. users unable to upgrade may avoid exposing vulnerable versions to untrusted input and closely monitor any unexpected server behaviour until they can upgrade.
- LOW
- NETWORK
- NONE
- UNCHANGED
- NONE
- NONE
- HIGH
- NONE
CWE-200 - Information Exposure
An information exposure vulnerability is categorized as an information flow (IF) weakness, which can potentially allow unauthorized access to otherwise classified information in the application, such as confidential personal information (demographics, financials, health records, etc.), business secrets, and the application's internal environment.
References
Advisory Timeline
- Published
