CVE-2023-42222

Description

WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.

References

https://www.electronjs.org/docs/latest/tutorial/security#15-do-not-use-shellopenexternal-with-untrusted-content

https://webcatalog.io/changelog/

https://github.com/itssixtyn3in/CVE-2023-42222

http://packetstormsecurity.com/files/176957/WebCatalog-48.4-Arbitrary-Protocol-Execution-Code-Execution.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS