CVE-2023-36123
Published: 07 October 2023
Summary
CVE-2023-36123 is a high-severity Path Traversal (CWE-22) vulnerability in Plain Craft Launcher 2 Project Plain Craft Launcher 2. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 6.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-36123 is a directory traversal vulnerability, tracked as CWE-22, that affects Hex-Dragon Plain Craft Launcher 2 in version Alpha 1.3.9. The flaw received a CVSS v3.1 base score of 7.8 with an attack vector of local access, low complexity, and low privileges required, resulting in high impact to confidentiality, integrity, and availability.
Local attackers can exploit the issue without user interaction to execute arbitrary code and obtain sensitive information on the affected system. The vulnerability stems from improper handling of directory paths, enabling traversal outside intended boundaries when the launcher processes certain inputs.
Public references consist of proof-of-concept material hosted on GitHub and Gist repositories, but no vendor advisories or official patches are referenced in the available data. The EPSS score stands at 0.1191 with an identical peak value, indicating no material increase in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-40102
Vulnerability details
Directory Traversal vulnerability in Hex-Dragon Plain Craft Launcher 2 version Alpha 1.3.9, allows local attackers to execute arbitrary code and gain sensitive information.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.