Paper/Archive/CVE-2023-47104

CVE-2023-47104

vareille tinyfiledialogs — tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messa…

EPSS 0.9%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 58.5.585 × 2011.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input data. NOTE: this issue exists because of an incomplete fix for CVE-2020-36767, which only considered single and double quote characters.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

tinyfiledialogs< 3.15.03.15.0CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/servo/servo/issues/25498#issuecomment-703527082 refsourceforge.net/p/tinyfiledialogs/code/ci/ac9f9f6d8cdf45ca8d9b4cf1f201ee472301e114