ExploitCVE-2023-46301
Improper Encoding or Escaping of Output (CWE-116)
Published: Oct 22, 2023 / Updated: 13mo ago
010
CVSS 9.8EPSS 0.05%Critical
CVE info copied to clipboard
iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
First Article
Feedly found the first article mentioning CVE-2023-46301. See article
Oct 22, 2023 at 4:12 AM / cve.report
CVE Assignment
NVD published the first details for CVE-2023-46301
Oct 22, 2023 at 4:15 AM
EPSS
EPSS Score was set to: 0.05% (Percentile: 14.3%)
Oct 22, 2023 at 2:17 PM
Detection in Vulnerability Scanners
Detection for the vulnerability has been added to Qualys (379861)
May 22, 2024 at 7:53 AM
Affected Systems
Iterm2/iterm2
+null more
Exploits
https://blog.solidsnail.com/posts/2023-08-28-iterm2-rce
+null more
Patches
github.com
+null more
Attack Patterns
CAPEC-104: Cross Zone Scripting
+null more
News
CVE-2023-46300 & CVE-2023-46301: iTerm2 Patches Potentially Dangerous Vulnerabilities
Recently, iTerm2 users were alerted to two security vulnerabilities that, if exploited, could potentially lead to remote code execution. In August, two versions, 3.4.20 and 3.5.0beta11, were rolled out to address specific security vulnerabilities that had the potential to leverage iTerm2 to execute commands under certain conditions.
CVE-2023-46301
Critical Severity Description iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload. Read more at https://www.tenable.com/cve/CVE-2023-46301
CVE-2023-46301 | iTerm2 up to 3.4.19 unrestricted upload
A vulnerability has been found in iTerm2 up to 3.4.19 and classified as critical . This vulnerability affects unknown code. The manipulation leads to unrestricted upload. This vulnerability was named CVE-2023-46301 . The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.
NA - CVE-2023-46301 - iTerm2 before 3.4.20 allow (potentially remote)...
iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload.
CVE-2023-46301
iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to...
See 5 more articles and social media posts