CVE-2022-23465 : SwiftTerm is a Xterm/VT100 Terminal emulator. Prior to commit a94e6b24d24ce9680a

SwiftTerm is a Xterm/VT100 Terminal emulator. Prior to commit a94e6b24d24ce9680ad79884992e1dff8e150a31, an attacker could modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands. Version a94e6b24d24ce9680ad79884992e1dff8e150a31 contains a patch for this issue. There are no known workarounds available.

Published 2022-12-02 23:15:17

Updated 2023-07-14 19:10:22

Source GitHub, Inc.

View at NVD, CVE.org

Products affected by CVE-2022-23465

Swiftterm Project » Swiftterm
Versions before (<) 2022-12-02
cpe:2.3:a:swiftterm_project:swiftterm:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-23465

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 27 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-23465

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.1	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N	1.8	4.7	GitHub, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: High Integrity: Low Availability: None

CWE ids for CVE-2022-23465

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Assigned by: security-advisories@github.com (Secondary)

References for CVE-2022-23465

https://github.com/migueldeicaza/SwiftTerm/commit/a94e6b24d24ce9680ad79884992e1dff8e150a31

Fix two possible attack vectors, where an attacker can store · migueldeicaza/SwiftTerm@a94e6b2 · GitHub
Patch;Third Party Advisory
https://github.com/migueldeicaza/SwiftTerm/security/advisories/GHSA-jq43-q8mx-r7mq

Attacker could modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malici
Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-23465

Products affected by CVE-2022-23465

Exploit prediction scoring system (EPSS) score for CVE-2022-23465

CVSS scores for CVE-2022-23465

CWE ids for CVE-2022-23465

References for CVE-2022-23465