VulnerabilityAnalyzed
CVE-2023-47104
tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input data.
CRITICAL 9.8EPSS 0.72%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input data. NOTE: this issue exists because of an incomplete fix for CVE-2020-36767, which only considered single and double quote characters.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.72% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78, CWE-77
- Affected
- vareille/tinyfiledialogs
- Source
- cve@mitre.org
References
- https://github.com/servo/servo/issues/25498#issuecomment-703527082Exploit, Issue Tracking, Third Party Advisory
- https://sourceforge.net/p/tinyfiledialogs/code/ci/ac9f9f6d8cdf45ca8d9b4cf1f201ee472301e114/Patch
- https://github.com/servo/servo/issues/25498#issuecomment-703527082Exploit, Issue Tracking, Third Party Advisory
- https://sourceforge.net/p/tinyfiledialogs/code/ci/ac9f9f6d8cdf45ca8d9b4cf1f201ee472301e114/Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.