What is GHSA-738q-mc72-2q22?

GHSA-738q-mc72-2q22 is a security advisory published by GitHub Security Advisories with High severity. MTProto proxy remote code execution vulnerability

Which CVE IDs does GHSA-738q-mc72-2q22 cover?

GHSA-738q-mc72-2q22 covers the following CVE IDs: CVE-2023-45312. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-738q-mc72-2q22?

GHSA-738q-mc72-2q22 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-738q-mc72-2q22?

GHSA-738q-mc72-2q22 affects 1 product, including: erlang/mtproto_proxy:\u003c= 0.7.2.

GHSA-738q-mc72-2q22HighCVSS 8.8

MTProto proxy remote code execution vulnerability

Vendor

GitHub Security Advisories

Published

October 10, 2023

Last Modified

November 5, 2023

🔗 CVE IDs covered (1)

CVE-2023-45312 →

📋 Description

In the mtproto_proxy (aka MTProto proxy) component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installation without authenticating and achieve remote command execution ability.

🎯 Affected products1

erlang/mtproto_proxy:<= 0.7.2

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-45312
https://medium.com/@_sadshade/almost-2000-telegram-proxy-servers-are-potentially-vulnerable-to-rce-since-2018-742a455be16b
https://github.com/advisories/GHSA-738q-mc72-2q22