by Kastro
Paper/Archive/CVE-2024-38395

CVE-2024-38395

iterm2 iterm2 — In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is…

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 74.0.740 × 2014.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."

Affected

ProductAffectedFixed inSource
n/an/a–CNA
iterm23.5.2–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refiterm2.com/downloads.htmlrefgitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219refopenwall.com/lists/oss-security/2024/06/15/1refgitlab.com/gnachman/iterm2/-/tags/v3.5.2refopenwall.com/lists/oss-security/2024/06/17/1