CVEvulnerability
CVE-2023-42222
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-09-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.
Affected configurations
• webcatalog webcatalog (< 49.0)
References
- http://packetstormsecurity.com/files/176957/WebCatalog-48.4-Arbitrary-Protocol-Execution-Code-Execution.html packetstormsecurity.com
- https://github.com/itssixtyn3in/CVE-2023-42222 Exploit, Third Party Advisory
- https://webcatalog.io/changelog/ Release Notes
- https://www.electronjs.org/docs/latest/tutorial/security#15-do-not-use-shellopenexternal-with-untrusted-content Third Party Advisory
- http://packetstormsecurity.com/files/176957/WebCatalog-48.4-Arbitrary-Protocol-Execution-Code-Execution.html packetstormsecurity.com
- https://github.com/itssixtyn3in/CVE-2023-42222 Exploit, Third Party Advisory
- https://webcatalog.io/changelog/ Release Notes
- https://www.electronjs.org/docs/latest/tutorial/security#15-do-not-use-shellopenexternal-with-untrusted-content Third Party Advisory