CVE-2023-41057
CVSS 3.1 Score 5.5 of 10 (medium)
Details
Summary
CVE-2023-41057 is a vulnerability affecting the command-line tool `hyper-bump-it`, used for updating version numbers in project files. The tool constructs a glob pattern based on a file pattern from a configuration file and the project root directory. While the intended files are supposed to be contained within the project root, this is not checked. This could lead to unintended files being modified, resulting in potential data leakage or unwanted changes. The tool's default behavior includes displaying planned changes and requiring user confirmation before editing, but the configuration file has a field that bypasses this prompt. This issue has been rectified in release version 0.5.1. It is highly recommended that users upgrade to address this vulnerability. As an additional precaution, users unable to update immediately can execute `hyper-bump-it` with the `--interactive` command-line argument, ensuring all planned changes are displayed and confirmed before implementation.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions