{"id":"CVE-2023-46586","details":"cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 (before 1.0) lacks '\\0' termination of the path for CGI scripts because strncpy is misused.","modified":"2026-08-12T14:51:23.562324Z","published":"2024-10-09T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46586.json"},"references":[{"type":"WEB","url":"https://github.com/ltworf/weborf/pull/88/commits/7057d254b734dfc9cfb58983f901aa6ec3c94fd4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46586.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46586"},{"type":"FIX","url":"https://github.com/ltworf/weborf/commit/49824204add55aab0568d90a6b1e7c822d32120d"},{"type":"FIX","url":"https://github.com/ltworf/weborf/commit/6f83c3e9ceed8b0d93608fd5d42b53c081057991"},{"type":"FIX","url":"https://github.com/ltworf/weborf/pull/88"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ltworf/weborf","events":[{"introduced":"0"},{"fixed":"49824204add55aab0568d90a6b1e7c822d32120d"},{"fixed":"6f83c3e9ceed8b0d93608fd5d42b53c081057991"}],"database_specific":{"source":"REFERENCES"}}],"versions":["0.20","0.19","0.18","0.17","0.16","0.15","0.14","0.13.5","0.13.4","0.13.3","0.13.2","0.13.1","0.13"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46586.json","vanir_signatures_modified":"2026-08-12T14:51:23Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/ltworf/weborf/commit/6f83c3e9ceed8b0d93608fd5d42b53c081057991","target":{"file":"cgi.c"},"deprecated":false,"digest":{"line_hashes":["81227580867746390961752078636075050189","159188990801594865319524115523987289052","174267724711931865594443984389288315850","147477139994229830322127848171587898131","133879674372307701498897249147529503469","129625435282755916530333024782517680551","318022707241103019451601384865392139122","151894198318135989003494211830130452089","179103408452640312475636629702641933301"],"threshold":0.9},"id":"CVE-2023-46586-34611f17","signature_type":"Line"},{"target":{"file":"cgi.c","function":"cgi_execute_child"},"deprecated":false,"digest":{"function_hash":"12647823630007513324655878607136192855","length":1093},"id":"CVE-2023-46586-3ae611e6","signature_type":"Function","signature_version":"v1","source":"https://github.com/ltworf/weborf/commit/49824204add55aab0568d90a6b1e7c822d32120d"},{"signature_version":"v1","source":"https://github.com/ltworf/weborf/commit/6f83c3e9ceed8b0d93608fd5d42b53c081057991","target":{"file":"cgi.c","function":"cgi_execute_child"},"deprecated":false,"digest":{"function_hash":"255128952180711984546354458810747632174","length":927},"id":"CVE-2023-46586-4a8f452e","signature_type":"Function"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["24353518695182608993129776085874660912","67127321974241560877115704860694648719","159188873847766903622661161944129159271","207965772452821526724947632566055810798","222532605526042771730287074896252769350"]},"id":"CVE-2023-46586-84470460","signature_type":"Line","signature_version":"v1","source":"https://github.com/ltworf/weborf/commit/49824204add55aab0568d90a6b1e7c822d32120d","target":{"file":"cgi.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}]}