RCE in Temporal

CVE-2023-3485

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires the namespace UUID and information from the workflow history for the target namespace. Under these conditions, it is possible to interfere with pending tasks in other namespaces, such as marking a task failed or completed. If a task is targeted for completion by the attacker, the targeted namespace must also be using the same data converter configuration as the initial, valid, namespace for the task completion payload to be decoded by workers in the target namespace.

Vulnerability class: Broken Access Control

Published · last modified .

CVSS v3 metric

CVSS v3 base score 3.0 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L.

EPSS exploit prediction

EPSS: 0.002 (5.3th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 5th percentile — 5.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2023-3485: held from 0.002 to 0.002.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2023-3485?
CVE-2023-3485 is a low-severity vulnerability in Temporal, classified under Incorrect Authorization. CVSS score: 3.0/10. Published 2023-06-30.
How severe is CVE-2023-3485?
Low severity. CVSS v3 base score is 3.0 out of 10.