Vulnerability Description
WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.
CVSS Score
8.8
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Webcatalog | Webcatalog | < 49.0 |
References
- http://packetstormsecurity.com/files/176957/WebCatalog-48.4-Arbitrary-Protocol-E
- https://github.com/itssixtyn3in/CVE-2023-42222ExploitThird Party Advisory
- https://webcatalog.io/changelog/Release Notes
- https://www.electronjs.org/docs/latest/tutorial/security#15-do-not-use-shellopenThird Party Advisory
- http://packetstormsecurity.com/files/176957/WebCatalog-48.4-Arbitrary-Protocol-E
- https://github.com/itssixtyn3in/CVE-2023-42222ExploitThird Party Advisory
- https://webcatalog.io/changelog/Release Notes
- https://www.electronjs.org/docs/latest/tutorial/security#15-do-not-use-shellopenThird Party Advisory
FAQ
What is CVE-2023-42222?
CVE-2023-42222 is a vulnerability with a CVSS score of 8.8 (HIGH). WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some cir...
How severe is CVE-2023-42222?
CVE-2023-42222 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-42222?
Check the references section above for vendor advisories and patch information. Affected products include: Webcatalog Webcatalog.