CVE-2023-45284

Incorrect detection of reserved device names on Windows in path/filepath

Medium · published November 9, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
59.4
In the wild
Unconfirmed
What it is

On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00903 · 59.4th percentile
Published
2023-11-09T16:30Z
EPSS history
Timeline
  • 09 NOV 16:30Z
    Incorrect detection of reserved device names on Windows in path/filepath
    cvelistv5