by Kastro
Paper/Archive/CVE-2022-23609

CVE-2022-23609

bildsben iTunesRPC-Remastered — Path traveresal in iTunesRPC-Remastered

EPSS 1%CVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 64.0.640 × 2012.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input used to remove files leading to file deletion only limited by the process permissions. Users are advised to upgrade as soon as possible.

Affected

ProductAffectedFixed inSource
iTunesRPC-Remasteredcommits prior to 1eb1e54–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GitHub_M (CNA)8.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/bildsben/iTunesRPC-Remastered/security/advisories/GHSA-cc8j-fr7v-7r6qrefgithub.com/bildsben/iTunesRPC-Remastered/commit/1eb1e5428f0926b2829a0bbbb65b0d946e608593