CVE-2023-35853 — Code Injection in Suricata
Severity
9.8CRITICALNVD
EPSS
0.7%
top 28.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 19
Description
In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages2 packages
Patches
🔴Vulnerability Details
3📋Vendor Advisories
1Debian▶
CVE-2023-35853: suricata - In Suricata before 6.0.13, an adversary who controls an external source of Lua r...↗2023