CVE-2023-42222

Published: Sep 28, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.

Affected (1)

Products: Webcatalog: Webcatalog

Webcatalog

1 product

Webcatalog

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Webcatalog Webcatalog	Before 49.0

References (8)

http://packetstormsecurity.com/files/176957/WebCatalog-48.4-Arbitrary-Protocol-Execution-Code-Execution.html

Source: cve@mitre.org

https://github.com/itssixtyn3in/CVE-2023-42222

Source: cve@mitre.org

ExploitThird Party Advisory

https://webcatalog.io/changelog/

Source: cve@mitre.org

Release Notes

https://www.electronjs.org/docs/latest/tutorial/security#15-do-not-use-shellopenexternal-with-untrusted-content

Source: cve@mitre.org

Third Party Advisory

http://packetstormsecurity.com/files/176957/WebCatalog-48.4-Arbitrary-Protocol-Execution-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/itssixtyn3in/CVE-2023-42222

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://webcatalog.io/changelog/

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://www.electronjs.org/docs/latest/tutorial/security#15-do-not-use-shellopenexternal-with-untrusted-content

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.