{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-22T11:47:46.296","vulnerabilities":[{"cve":{"id":"CVE-2023-46122","sourceIdentifier":"security-advisories@github.com","published":"2023-10-23T16:15:09.383","lastModified":"2024-11-21T08:27:55.507","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7."},{"lang":"es","value":"sbt es una herramienta de compilación para Scala, Java y otros. Dado un archivo zip o JAR especialmente manipulado, `IO.unzip` permite escribir archivos arbitrarios. Esto tendría potencial para sobrescribir `/root/.ssh/authorized_keys`. Dentro del código principal de sbt, `IO.unzip` se usa en la tarea `pullRemoteCache` y `Resolvers.remote`; sin embargo, muchos proyectos utilizan `IO.unzip(...)` directamente para implementar tareas personalizadas. Esta vulnerabilidad ha sido parcheada en la versión 1.9.7."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","baseScore":3.9,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.3,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:scala-sbt:io:*:*:*:*:*:sbt:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.9.7","matchCriteriaId":"E26E7679-8BEF-4E54-9908-CD46A514E6CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:scala-sbt:sbt:*:*:*:*:*:*:*:*","versionStartIncluding":"0.3.4","versionEndExcluding":"1.9.7","matchCriteriaId":"5520A3FF-F431-48C6-B5E7-C238800BF059"}]}]}],"references":[{"url":"https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/sbt/io/issues/358","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/sbt/io/pull/360","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf","source":"security-advisories@github.com","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/sbt/io/issues/358","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/sbt/io/pull/360","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"]}]}}]}