PT-2022-16118 · Unknown · Itunesrpc-Remastered

Benjjvi · Published 2022-02-01 · Updated 2023-06-27 · CVE-2022-23603

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions iTunesRPC-Remastered versions prior to commit 24f43aa

Description The issue concerns a discord rich presence application for use with iTunes & Apple Music, where user input is not properly sanitized, allowing code injection. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Recommendations For versions prior to commit 24f43aa, upgrade to a version after commit 24f43aa as soon as possible to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of code injection until a patch is available.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2022-23603

GHSA-3XPP-RHQX-CW96

Affected Products

Itunesrpc-Remastered

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23603.json · Exploit
• https://github.com/bildsben/iTunesRPC-Remastered/commit/54b02d9f3a94de94e4fb471908b8cf798e62e411 · Patch
• https://github.com/bildsben/iTunesRPC-Remastered/commit/24f43aac0f4116b3d89fdbe973ba92c6cfb0d998 · Patch
• https://github.com/bildsben/iTunesRPC-Remastered/security/advisories/GHSA-3xpp-rhqx-cw96 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23603 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23603 · Vendor Advisory
• https://t.me/cvenotify/53100 · Telegram Post