by Kastro
Paper/Archive/CVE-2022-23611

CVE-2022-23611

bildsben iTunesRPC-Remastered — OS command injection in iTunesRPC-Remastered

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 72.5.725 × 2014.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file paths leading to OS level command injection. This issue has been patched in commit cdcd48b. Users are advised to upgrade.

Affected

ProductAffectedFixed inSource
iTunesRPC-RemasteredCommits prior to cdcd48b–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/bildsben/iTunesRPC-Remastered/security/advisories/GHSA-mjv7-r62p-vhhgrefgithub.com/bildsben/iTunesRPC-Remastered/commit/cdcd48bbc44009ddcbd07a809b87376dc9ce37f4