Paper/Archive/CVE-2022-42496

CVE-2022-42496

kujirahand Nako3edit, editor component of nadesiko3 (PC Version) — OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker…

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 82.1.821 × 2016.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to obtain appkey of the product and execute an arbitrary OS command on the product.

Affected

ProductAffectedFixed inSource

Nako3edit, editor component of nadesiko3 (PC Version)v3.3.74 and earlier–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/kujirahand/nadesiko3/issues/1325 refgithub.com/kujirahand/nadesiko3/issues/1347 refjvn.jp/en/jp/JVN56968681/index.html