Lucene search

BitdefenderCVELIST:CVE-2023-6318

HistoryApr 09, 2024 - 1:41 p.m.

CVE-2023-6318 Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service

2024-04-0913:41:47

CWE-78

Bitdefender

www.cve.org

webos

command injection

root user

authenticated requests

oled55cxpua

oled48c1pub

oled55a23la

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

Percentile

9.6%

JSON

A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability.

Full versions and TV models affected:

webOS 5.5.0 - 04.50.51 running on OLED55CXPUA
webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB
webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "webOS",
    "vendor": "LG",
    "versions": [
      {
        "status": "affected",
        "version": "5.5.0"
      },
      {
        "status": "affected",
        "version": "6.3.3-442"
      },
      {
        "status": "affected",
        "version": "7.3.1-43 "
      }
    ]
  }
]

References

bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/

lgsecurity.lge.com/bulletins/tv#updateDetails

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

Percentile

9.6%

JSON

Related for CVELIST:CVE-2023-6318