CVE-2023-39150 : ConEmu before commit 230724 does not sanitize title responses correctly for cont

ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is related to an incomplete fix for CVE-2022-46387.

Published 2023-09-12 13:15:08

Updated 2023-10-05 13:14:16

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2023-39150

Maximus5 » Conemu
Versions before (<) 23.07.24
cpe:2.3:a:maximus5:conemu:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-39150

EPSS FAQ

0.28%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 68 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-39150

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2023-39150

https://github.com/Maximus5/ConEmu/commit/60683a186628ffaa7689fcb64b3c38ced69287c1

gh-2536: Do not emit control characters in title reports (capability … · Maximus5/ConEmu@60683a1 · GitHub
Patch
https://gist.github.com/dgl/081cf503dc635df39d844e058a6d4c88

gist:081cf503dc635df39d844e058a6d4c88 · GitHub
Third Party Advisory

Jump to

Vulnerability Details : CVE-2023-39150

Products affected by CVE-2023-39150

Exploit prediction scoring system (EPSS) score for CVE-2023-39150

CVSS scores for CVE-2023-39150

References for CVE-2023-39150