CVE-2023-32078 json
Netmaker IDOR Vulnerability Allows User to Update Other User's Password
published 2023-08-24 3 y ago modified 2026-09-10 1 mo ago also GHSA-256m-j5qw-38f4 , GO-2023-2023 , EUVD-2023-2183
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0.18.6 in the user update function. By specifying another user's username, it was possible to update the other user's password. The issue is patched in 0.17.1 and fixed in 0.18.6. If Users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone using version 0.17.1 can pull the latest docker image of the backend and restart the server.
Patch / fix
- go github.com/gravitl/netmaker 0.17.1, 0.18.6
- netmaker netmaker 0.17.1
- github.com/gravitl/netmaker@b3be57c commit
- github.com/gravitl/netmaker#2158 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.69% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/gravitl/netmaker | <0.17.1 >=0.18.0, <0.18.6 |
0.17.1 0.18.6 |
Affected products
- gravitl netmaker
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
github.com
/gravitl/netmaker/pull/2158
web, patch
-
github.com
/gravitl/netmaker/commit/b3be57c65bf0bbfab43b66853c8e3637a43e2839
web, patch
-
github.com
/gravitl/netmaker/security/advisories/GHSA-256m-j5qw-38f4
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-32078
advisory
-
github.com
/gravitl/netmaker
package
Sources
- CVE List CVE-2023-32078
- GitHub Advisory GHSA-256m-j5qw-38f4
- NVD CVE-2023-32078
- OSV GO-2023-2023
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.