CVE-2023-38942 : Dango-Translator v4.5.5 was discovered to contain a remote command execution (RC

Dango-Translator v4.5.5 was discovered to contain a remote command execution (RCE) vulnerability via the component app/config/cloud_config.json.

Published 2023-08-03 19:15:11

Updated 2023-08-14 18:40:24

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2023-38942

Dango » Dango-translator » Version: 4.5.5
cpe:2.3:a:dango:dango-translator:4.5.5:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

4.39%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 88 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

https://github.com/PantsuDango/Dango-Translator

GitHub - PantsuDango/Dango-Translator: 团子翻译器 —— 个人兴趣制作的一款基于OCR技术的翻译器
Product
https://github.com/PantsuDango/Dango-Translator/issues/127

[Warning] Hijacked Remote Command Execute in Dango-Translator Ver4.5.5 · Issue #127 · PantsuDango/Dango-Translator · GitHub
Exploit;Issue Tracking;Patch;Vendor Advisory

Jump to