CVE-2023-43621

Reference page built from the source records below, each shown as its source publishes it. Dataset version ref-f493a1a092af, updated 2026-06-17T06:26:05.317Z.

NVD analysis

Status
Modified
Published
2023-09-20T06:15:10.950
Last modified
2026-06-17T06:26:05.317
Weaknesses
NVD-CWE-noinfo

An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all processes and their arguments.

MetricScoreSeverityVectorScored by
CVSS 3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N[email protected] (Primary)

References

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-03T01:44:53.827Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-43621

CVE record

Assigner
mitre
State
PUBLISHED
Published
2023-09-20T00:00:00.000Z
Updated
2024-09-24T18:31:10.115Z
Problem types
n/a

An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all processes and their arguments.

References

Read on 2026-11-03T02:04:44.811Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/43xxx/CVE-2023-43621.json

GitHub Advisory Database

GHSA-7g3v-4ggr-xvjf: Croc may expose secret to local users

Severity (GitHub)
medium
CVSS
4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Published
2023-09-20T06:30:50Z
Updated
2024-05-21T18:18:33Z
  • go github.com/schollz/croc/v9: affected < 9.6.16, first patched 9.6.16

An issue was discovered in Croc before 9.6.16. The shared secret, located on a command line, can be read by local users who list all processes and their arguments.

Read on 2026-11-03T08:52:27.764Z under licence ghsa-cc-by-4.0@9e5f1b3c from https://api.github.com/advisories/GHSA-7g3v-4ggr-xvjf

Also known as / affected packages

Detection rules (SigmaHQ)

SigmaHQ rules whose own tags name this CVE. Each rule page shows the rule as its author published it.

Sources and licences

  • National Vulnerability Database (NIST)

    This product uses the NVD API but is not endorsed or certified by the NVD.

    NVD API Terms of Use (NIST publications in the public domain, 17 U.S.C. 105)

  • CVE Program, The MITRE Corporation

    Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

    CVE Program Terms of Use ("CVE Usage" licence)

  • GitHub Advisory Database

    Source: GitHub Advisory Database, https://github.com/advisories/GHSA-7g3v-4ggr-xvjf, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Changes: fields selected and reformatted by ransomware-tracker.com.

    CC BY 4.0

  • GitHub Advisory Database via OSV.dev

    GHSA-7g3v-4ggr-xvjf: GitHub Advisory Database, https://github.com/advisories/GHSA-7g3v-4ggr-xvjf. Licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), provided as is, without warranties. Retrieved via OSV.dev (https://osv.dev/vulnerability/GHSA-7g3v-4ggr-xvjf), which enriches records; fields selected and reformatted by ransomware-tracker.com.

    CC BY 4.0

  • SigmaHQ

    "Potential Information Disclosure CVE-2023-43261 Exploitation - Web" by Nasreddine Bencherchali (Nextron Systems), Thurein Oo (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/Exploits/CVE-2023-43261/web_exploit_cve_2023_43261_milesight_information_disclosure.yml.
    Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License

    Detection Rule License (DRL) 1.1

  • SigmaHQ

    "Potential Information Disclosure CVE-2023-43261 Exploitation - Proxy" by Nasreddine Bencherchali (Nextron Systems), Thurein Oo (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/Exploits/CVE-2023-43261/proxy_exploit_cve_2023_43261_milesight_information_disclosure.yml.
    Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License

    Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "CVE-2023-43621",
entity page, dataset version ref-f493a1a092af, updated 2026-06-17T06:26:05.317Z,
https://ransomware-tracker.com/cve/CVE-2023-43621 (accessed 2026-11-03).
Underlying source: National Vulnerability Database (NIST), CVE API 2.0, record last modified 2026-06-17T06:26:05.317.
Underlying source: CVE List (CVE Program, The MITRE Corporation), record updated 2024-09-24T18:31:10.115Z.
Underlying source: GitHub Advisory Database, GHSA-7g3v-4ggr-xvjf, updated 2024-05-21T18:18:33Z.
Underlying source: GitHub Advisory Database, GHSA-7g3v-4ggr-xvjf, via OSV.dev, modified 2026-09-10T03:49:57.862297853Z.
Underlying source: SigmaHQ rule a2bcca38-9f3a-4d5e-b603-0c587e8569d7, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.
Underlying source: SigmaHQ rule f48f5368-355c-4a1b-8bf5-11c13d589eaa, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.

CISA KEV index