CVEvulnerability
CVE-2022-46387
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2023-03-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-116
Description
ConEmu through 220807 and Cmder before 1.3.21 report the title of the terminal, including control characters, which allows an attacker to change the title and then execute it as commands.
Affected configurations
• cmder cmder (< 1.3.2)
• maximus5 conemu (<= 22.08.07)
Related
Weakness · CWE (1)
- CWE-116 Improper Encoding or Escaping of Output weakness
References
- https://gist.github.com/dgl/05ca60cdc7efc9e47bbc58d0c952635e Third Party Advisory
- https://github.com/cmderdev/cmder/blob/master/CHANGELOG.md Release Notes
- https://gist.github.com/dgl/05ca60cdc7efc9e47bbc58d0c952635e Third Party Advisory
- https://github.com/cmderdev/cmder/blob/master/CHANGELOG.md Release Notes