CVE-2023-46301 - Vulnerability Details - OpenCVE

iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Iterm2	Iterm2

Configuration 1 [-]

cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://blog.solidsnail.com/posts/2023-08-28-iterm2-rce
https://github.com/gnachman/iTerm2/commit/85cbf5ebda472c9ec295887e99c2b6f1b5867f1b
https://github.com/gnachman/iTerm2/commit/b2268b03b5f3d4cd8ca275eaef5d16d0fac20009
https://iterm2.com/news.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-10-22T00:00:00

Updated: 2024-09-12T17:48:57.452Z

Reserved: 2023-10-22T00:00:00

Link: CVE-2023-46301

Vulnrichment

Updated: 2024-08-02T20:45:40.697Z

NVD

Status : Modified

Published: 2023-10-22T04:15:09.797

Modified: 2024-11-21T08:28:15.530

Link: CVE-2023-46301

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE5A8378-60FE-4F69-A7AA-DEE9393C51C8", "versionEndExcluding": "3.4.20", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload."}, {"lang": "es", "value": "iTerm2 anterior a 3.4.20 permite la ejecuci\u00f3n de c\u00f3digo (potencialmente remota) debido al mal manejo de ciertas secuencias de escape relacionadas con la carga."}], "id": "CVE-2023-46301", "lastModified": "2024-11-21T08:28:15.530", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-22T04:15:09.797", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.solidsnail.com/posts/2023-08-28-iterm2-rce"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/gnachman/iTerm2/commit/85cbf5ebda472c9ec295887e99c2b6f1b5867f1b"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/gnachman/iTerm2/commit/b2268b03b5f3d4cd8ca275eaef5d16d0fac20009"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://iterm2.com/news.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.solidsnail.com/posts/2023-08-28-iterm2-rce"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/gnachman/iTerm2/commit/85cbf5ebda472c9ec295887e99c2b6f1b5867f1b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/gnachman/iTerm2/commit/b2268b03b5f3d4cd8ca275eaef5d16d0fac20009"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://iterm2.com/news.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "nvd@nist.gov", "type": "Primary"}]}