Lucene search

GitHub_MCVELIST:CVE-2022-23611

HistoryFeb 04, 2022 - 10:32 p.m.

CVE-2022-23611 OS command injection in iTunesRPC-Remastered

2022-02-0422:32:53

CWE-78

GitHub_M

www.cve.org

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H

9.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.1%

JSON

iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file paths leading to OS level command injection. This issue has been patched in commit cdcd48b. Users are advised to upgrade.

CNA Affected

[
  {
    "product": "iTunesRPC-Remastered",
    "vendor": "bildsben",
    "versions": [
      {
        "status": "affected",
        "version": "Commits prior to cdcd48b"
      }
    ]
  }
]

References

github.com/bildsben/iTunesRPC-Remastered/commit/cdcd48bbc44009ddcbd07a809b87376dc9ce37f4

github.com/bildsben/iTunesRPC-Remastered/security/advisories/GHSA-mjv7-r62p-vhhg

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H

9.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.1%

JSON

Related for CVELIST:CVE-2022-23611