CVE-2023-47113CWE-427

DLL Search Order Hijacking vulnerability in BleachBit for Windows

High · published November 8, 2023

CVSS v3.1
7.3
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.4.2 is vulnerable to a DLL Hijacking vulnerability. By placing a DLL in the Folder c:\DLLs, an attacker can run arbitrary code on every execution of BleachBit for Windows. This issue has been patched in version 4.5.0.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00247 · 15.1th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2023-11-08T21:57Z
EPSS history
Timeline
  • 08 NOV 21:57Z
    DLL Search Order Hijacking vulnerability in BleachBit for Windows
    cvelistv5