Vulnerability · Published Feb 4, 2022 · Assigned by GitHub_M
CVE-2022-23611OS command injection in iTunesRPC-Remastered
High 8.1
In plain English
A high-severity OS command injection in iTunesRPC-Remastered from bildsben. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)1.4%top 27.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file paths leading to OS level command injection. This issue has been patched in commit cdcd48b. Users are advised to upgrade.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bildsben | iTunesRPC-Remastered | Commits prior to cdcd48b |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H