CVE-2023-43799CWE-20

The Altair Desktop Client Does Not Sanitize External URLs before passing them to the underlying system

Medium · published October 4, 2023

CVSS v3.1
5.0
EPSS
0%
Percentile
11.5
In the wild
Unconfirmed
What it is

Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the underlying system. Moreover, Altair GraphQL Client also does not isolate the context of the renderer process. This affects versions of the software running on MacOS, Windows, and Linux. Version 5.2.5 fixes this issue.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00217 · 11.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-10-04T20:37Z
EPSS history
Timeline
  • 04 OCT 20:37Z
    The Altair Desktop Client Does Not Sanitize External URLs before passing them to the underlying system
    cvelistv5