Command Injection Vulnerability in ConEmu and Cmder Products
CVE-2022-46387

9.8CRITICAL

Key Information:

Vendor

Cmder

Status
Cmder
Vendor
CVE Published:
28 March 2023

What is CVE-2022-46387?

The vulnerability found in ConEmu versions prior to 220807 and in Cmder versions before 1.3.21 allows attackers to exploit terminal title commands. By manipulating the terminal title, an attacker can execute unwanted commands, creating a significant risk of control over the affected system. This security flaw emphasizes the need for proper input validation to safeguard against command injection attacks.

References

https://github.com/cmderdev/cmder/blob/master/CHANGELOG.md
https://gist.github.com/dgl/05ca60cdc7efc9e47bbc58d0c952635e

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.