CVE-2023-46322

iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial character may be non-alphanumeric. The hostname's other characters may be outside the set of alphanumeric characters, dash, and period.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gnachman/iterm2/-/commit/ef7bb84520013b2524df9787d4aa9f2c96746c01	Third Party Advisory
https://iterm2.com/downloads.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:iterm2:iterm2::::::::
	cpe:2.3:a:iterm2:iterm2:3.5.0:beta1::::::
	cpe:2.3:a:iterm2:iterm2:3.5.0:beta10::::::
	cpe:2.3:a:iterm2:iterm2:3.5.0:beta2::::::
	cpe:2.3:a:iterm2:iterm2:3.5.0:beta3::::::
	cpe:2.3:a:iterm2:iterm2:3.5.0:beta4::::::
	cpe:2.3:a:iterm2:iterm2:3.5.0:beta5::::::
	cpe:2.3:a:iterm2:iterm2:3.5.0:beta6::::::
	cpe:2.3:a:iterm2:iterm2:3.5.0:beta7::::::
	cpe:2.3:a:iterm2:iterm2:3.5.0:beta8::::::
	cpe:2.3:a:iterm2:iterm2:3.5.0:beta9::::::

History

11 Sep 2024, 21:35

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-23 00:15

Updated : 2024-09-11 21:35

NVD link : CVE-2023-46322

Mitre link : CVE-2023-46322

CVE.ORG link : CVE-2023-46322

JSON object : View

Products Affected

iterm2

iterm2

CWE

NVD-CWE-noinfo CWE-117

Improper Output Neutralization for Logs

{"id": "CVE-2023-46322", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-10-23T00:15:08.560", "references": [{"url": "https://gitlab.com/gnachman/iterm2/-/commit/ef7bb84520013b2524df9787d4aa9f2c96746c01", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://iterm2.com/downloads.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-117"}]}], "descriptions": [{"lang": "en", "value": "iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial character may be non-alphanumeric. The hostname's other characters may be outside the set of alphanumeric characters, dash, and period."}, {"lang": "es", "value": "iTermSessionLauncher.m en iTerm2 anterior a 3.5.0beta12 no sanitiza los nombres de host ssh en las URL. El car\u00e1cter inicial del nombre de host puede no ser alfanum\u00e9rico. Los dem\u00e1s caracteres del nombre de host pueden estar fuera del conjunto de caracteres alfanum\u00e9ricos, guiones y puntos."}], "lastModified": "2024-09-11T21:35:04.767", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DCBDFA5-07B5-4D12-95A7-EE26C15F0CCE", "versionEndIncluding": "3.4.21"}, {"criteria": "cpe:2.3:a:iterm2:iterm2:3.5.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37F1A1C2-AA8A-45A2-BCC7-36289E434567"}, {"criteria": "cpe:2.3:a:iterm2:iterm2:3.5.0:beta10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A632C6D5-2180-4B02-B8F1-EBE4442C1BE6"}, {"criteria": "cpe:2.3:a:iterm2:iterm2:3.5.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A35ECC8-B179-449F-97D7-47017B89E269"}, {"criteria": "cpe:2.3:a:iterm2:iterm2:3.5.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E238E921-DEC6-470E-94C3-9ACFCAE47C95"}, {"criteria": "cpe:2.3:a:iterm2:iterm2:3.5.0:beta4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13D2A7C5-650D-456D-97E0-79D146657A43"}, {"criteria": "cpe:2.3:a:iterm2:iterm2:3.5.0:beta5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E67A594B-4ECA-4189-9C3A-08AF188F82DF"}, {"criteria": "cpe:2.3:a:iterm2:iterm2:3.5.0:beta6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62D4145E-8CAA-439D-B917-BE332800EEC9"}, {"criteria": "cpe:2.3:a:iterm2:iterm2:3.5.0:beta7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5622F6B3-ECFC-44D7-AD72-1EBE28E8889D"}, {"criteria": "cpe:2.3:a:iterm2:iterm2:3.5.0:beta8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E81D1628-8B0A-4DC8-B176-6A2827D91F80"}, {"criteria": "cpe:2.3:a:iterm2:iterm2:3.5.0:beta9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6AC4F001-2578-46FE-996F-82DCB5DF3511"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}