CVE-2023-6602 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
redhat	CNA	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA-ADP	ADP	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 51%

Vendor	Product	Version
ffmpeg	ffmpeg	2.0 ≤ 𝑥 ≤ 6.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ffmpeg

bullseye	vulnerable
bullseye (security)	vulnerable
bookworm	vulnerable
bookworm (security)	vulnerable
sid	vulnerable
trixie	vulnerable

Known Exploits!

Common Weakness Enumeration

CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
The software receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2334338

https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html

https://bugzilla.redhat.com/show_bug.cgi?id=2334338