CVE-2023-32077

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6. If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-321 CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Aug 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-320787.5Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0 CVE-2023-320798.8Netmaker makes networks with WireGuard. A Mass assignment vulnerability was found in versions prior to 0.17.1 and 0.18.6 that allows a non-a CVE-2023-32088.8A vulnerability, which was classified as critical, has been found in RoadFlow Visual Process Engine .NET Core Mvc 2.13.3. Affected by this i CVE-2023-320808.8Wings is the server control plane for Pterodactyl Panel. A vulnerability affecting versions prior to 1.7.5 and versions 1.11.0 prior to 1.11 CVE-2023-320816.5Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 CVE-2023-320824.3etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allo CVE-2023-320834.9Microsoft Failover Cluster Information Disclosure Vulnerability CVE-2023-320847.5HTTP.sys Denial of Service Vulnerability CVE-2023-320855.5Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability CVE-2023-320876.1Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation CVE-2023-320886.1Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation CVE-2023-320896.1Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description