PT-2023-30311 · Unknown · Tinyfiledialogs

Ytvwldo · Published 2023-10-30 · Updated 2024-09-09 · CVE-2023-47104

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tinyfiledialogs versions prior to 3.15.0

Description The issue allows shell metacharacters, such as a backquote or a dollar sign, in titles, messages, and other input data. This problem exists due to an incomplete fix for a previous issue, which only considered single and double quote characters.

Recommendations For versions prior to 3.15.0, update to version 3.15.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of shell metacharacters in input data to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2023-47104

Affected Products

Tinyfiledialogs

References · 9

• 🔥 https://github.com/servo/servo/issues/25498#issuecomment-703527082 · Exploit
• https://osv.dev/vulnerability/CVE-2023-47104 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47104 · Security Note
• https://sourceforge.net/p/tinyfiledialogs/code/ci/ac9f9f6d8cdf45ca8d9b4cf1f201ee472301e114 · Patch
• https://t.me/latest_high_impact_cve/75 · Telegram Post
• https://t.me/cibsecurity/73167 · Telegram Post
• https://t.me/cvenotify/93888 · Telegram Post
• https://twitter.com/CVEnew/status/1719061481252364496 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1719089438959992885 · Twitter Post