CVE-2023-42222

Katalog CVE

CVSS 8.8 · High EPSS 1,7%

Kerentanan pada webcatalog. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.

Rincian

Terbit di NVD

28 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/itssixtyn3in/CVE-2023-42222 exploit · advisory pihak ketiga
• https://www.electronjs.org/docs/latest/tutorial/security#15-do-not-use-shellopenexternal-with-untrusted-conten... advisory pihak ketiga
• http://packetstormsecurity.com/files/176957/WebCatalog-48.4-Arbitrary-Protocol-Execution-Code-Execution.html
• https://webcatalog.io/changelog/ release notes