CVE-2022-41945CWE-94

Remote Code Execution (RCE) vulnerability in super-xray via URL input

Medium · published November 21, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

super-xray is a vulnerability scanner (xray) GUI launcher. In version 0.1-beta, the URL is not filtered and directly spliced ​​into the command, resulting in a possible RCE vulnerability. Users should upgrade to super-xray 0.2-beta.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00836 · 57.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2022-11-21T00:00Z
EPSS history
Timeline
  • 21 NOV 00:00Z
    Remote Code Execution (RCE) vulnerability in super-xray via URL input
    cvelistv5