CVE-2023-2479CWE-78

OS Command Injection in appium/appium-desktop

Critical · published May 2, 2023

CVSS v3.0
9.8
EPSS
22%
Percentile
97.7
In the wild
Unconfirmed
What it is

🚨 An OS command injection vulnerability lurking in Appium Desktop could let attackers execute arbitrary commands on your system! 🔥 This is like leaving your front door wide open while you’re away — a sneaky thief can just walk in and do whatever they want without breaking a sweat! An attacker could take complete control of your machine, install malicious software, steal sensitive data, or even launch further attacks on your network. The implications are absolutely devastating, especially if sensitive information is at stake!

Put simply

This is like leaving your front door wide open while you’re away — a sneaky thief can just walk in and do whatever they want without breaking a sweat! In versions prior to v1.22.3-4, Appium Desktop allows an OS command injection through user-supplied input, meaning attackers could exploit this to run commands on the host system without authentication.

What to do

An attacker could take complete control of your machine, install malicious software, steal sensitive data, or even launch further attacks on your network. The implications are absolutely devastating, especially if sensitive information is at stake! Immediately patch to version 1.22.3-4 or above to close this critical vulnerability. Review your configurations and restrict access to trusted users only to minimize risk. Keep your dependencies up to date! You've got this! Follow these steps and you'll lock down your system in no time. 🛡️

The record
Technical detail
CVSS v3.0
9.8 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.22014 · 97.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2023-05-02T00:00Z
EPSS history
Timeline
  • 02 MAY 00:00Z
    OS Command Injection in appium/appium-desktop
    cvelistv5