VulnerabilityModified
CVE-2022-3008
This function allows for command injection by using backticks.
HIGH 8.8EPSS 3.03%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.03%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. We recommend upgrading to 2.6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 3.03% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78, CWE-77
- Affected
- tinygltf project/tinygltf · debian/debian linux
- Source
- cve-coordination@google.com
References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49053Exploit, Issue Tracking, Mailing List, Third Party Advisory
- https://github.com/syoyo/tinygltf/blob/master/README.mdProduct, Third Party Advisory
- https://github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c751Patch, Third Party Advisory
- https://github.com/syoyo/tinygltf/issues/368Exploit, Issue Tracking, Patch, Third Party Advisory
- https://www.debian.org/security/2022/dsa-5232Third Party Advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49053Exploit, Issue Tracking, Mailing List, Third Party Advisory
- https://github.com/syoyo/tinygltf/blob/master/README.mdProduct, Third Party Advisory
- https://github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c751Patch, Third Party Advisory
- https://github.com/syoyo/tinygltf/issues/368Exploit, Issue Tracking, Patch, Third Party Advisory
- https://www.debian.org/security/2022/dsa-5232Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.