CVE-2023-40185 Vulnerability Details

  /     /     /  

CVE-2023-40185 Metadata Quick Info

CVE Published: 23/08/2023 | CVE Updated: 30/09/2024 | CVE Year: 2023
Source: GitHub_M | Vendor: ericcornelissen | Product: shescape
Status : PUBLISHED

---

CVE-2023-40185 Description

shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell. This bug has been patched in version 1.7.4.

Metrics

CVSS Version: 3.1 | Base Score: 6.5 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* HIGH
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* CHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* LOW
    Integrity Impact (I)* LOW
    Availability Impact (A)* LOW

Weakness Enumeration (CWE)

CWE-ID: CWE-150
CWE Name: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Source: ericcornelissen

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description: