CVE-2023-34460 json
Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
published 3y ago modified 2mo ago also EUVD-2023-1905 , GHSA-wmff-grcw-jcfm
- cvss
- 4.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the `fs` endpoint are affected. The regression has been patched on version 1.4.1.
Patch / fix
- crates.io tauri 1.4.1
- github.com/tauri-apps/tauri@066c09a commit
- github.com/tauri-apps/tauri#6969 pull request
- github.com/tauri-apps/tauri#7227 pull request
Is CVE-2023-34460 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-14).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.8 | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 4.8 | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | tauri | >=1.4.0, <1.4.1 |
1.4.1 |
Affected products
- tauri-apps tauri
Classification
- Weakness
-
- CWE-285 Improper Authorization
References
-
github.com
/tauri-apps/tauri/pull/6969#discussion_r1232018347
web, issue-tracking, patch
-
github.com
/tauri-apps/tauri/pull/7227
web, patch
-
github.com
/tauri-apps/tauri/commit/066c09a6ea06f42f550d090715e06beb65cd5564
web, patch
-
github.com
/tauri-apps/tauri/security/advisories/GHSA-wmff-grcw-jcfm
web, third-party-advisory, advisory
-
github.com
/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-34460
advisory
-
github.com
/tauri-apps/tauri
package
Sources
- CVE List CVE-2023-34460
- GitHub Advisory GHSA-wmff-grcw-jcfm
- NVD CVE-2023-34460
- Maintainer advisory GHSA-wmff-grcw-jcfm
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of tauri-apps/tauri published their own advisory on GitHub. Reviewed sources take precedence over it.