PT-2023-30311 · Unknown · Tinyfiledialogs

Ytvwldo · Publicado 2023-10-30 · Atualizado 2024-09-09 · CVE-2023-47104

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tinyfiledialogs versions prior to 3.15.0

Description The issue allows shell metacharacters, such as a backquote or a dollar sign, in titles, messages, and other input data. This problem exists due to an incomplete fix for a previous issue, which only considered single and double quote characters.

Recommendations For versions prior to 3.15.0, update to version 3.15.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of shell metacharacters in input data to minimize the risk of exploitation.

Exploit

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

CVE-2023-47104

Produtos afetados

Tinyfiledialogs

Referências · 9

• 🔥 https://github.com/servo/servo/issues/25498#issuecomment-703527082 · Exploit
• https://osv.dev/vulnerability/CVE-2023-47104 · Aviso do Fabricante
• https://t.me/latest_high_impact_cve/75 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-47104 · Nota de Segurança
• https://t.me/cibsecurity/73167 · Publicação no Telegram
• https://sourceforge.net/p/tinyfiledialogs/code/ci/ac9f9f6d8cdf45ca8d9b4cf1f201ee472301e114 · Correção
• https://t.me/cvenotify/93888 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1719061481252364496 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1719089438959992885 · Publicação no Twitter