CVE-2023-42222

Published Sep 28, 2023

Last updated a year ago

Overview

Description: WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: NVD-CWE-Other

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:webcatalog:webcatalog:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B016158B-8577-4858-BEF0-403269B34BB4",
            "versionEndExcluding": "49.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References