CVE-2023-34642

Published: Jun 19, 2023Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attackers to open a file dialog box via the function showDirectoryPicker() which can then be used to open an unprivileged command prompt.

Affected (1)

Products: Kioware: Kioware

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Kioware Kioware	Up to 8.33

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (6)

https://github.com/huntergregal/CVE/tree/main/CVE-2023-34642

Source: cve@mitre.org

https://github.com/huntergregal/CVE/tree/main/TBD-KIOWARE-002

Source: cve@mitre.org

Broken Link

https://www.kioware.com/versionhistory.aspx?pid=15

Source: cve@mitre.org

Release Notes

https://github.com/huntergregal/CVE/tree/main/CVE-2023-34642

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/huntergregal/CVE/tree/main/TBD-KIOWARE-002

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://www.kioware.com/versionhistory.aspx?pid=15

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

Timeline

No history available yet.