CVE-2023-42222
moderate-risk
Published 2023-09-28
WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.
Do I need to act?
~
4.4% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10
High
NETWORK
/ LOW complexity
Affected Products (1)
Webcatalog
Affected Vendors
References (8)
Release Notes
https://webcatalog.io/changelog/
Third Party Advisory
https://www.electronjs.org/docs/latest/tutorial/security#15-do-not-use-shellopen...
Release Notes
https://webcatalog.io/changelog/
Third Party Advisory
https://www.electronjs.org/docs/latest/tutorial/security#15-do-not-use-shellopen...
43
/ 100
moderate-risk
Severity
30/34 · Critical
Exploitability
8/34 · Low
Exposure
5/34 · Minimal