CVE-2024-22169CWE-94

Misconfiguration in node.js causing a code execution in WD Discovery

High · published August 2, 2024

CVSS v4.0
7.1
EPSS
0%
Percentile
16.6
In the wild
Unconfirmed
What it is

WD Discovery

versions prior to 5.0.589 contain a misconfiguration in the Node.js environment

settings that could allow code execution by utilizing the 'ELECTRON_RUN_AS_NODE' environment variable.

Any malicious application operating with standard user permissions can exploit

this vulnerability, enabling code execution within WD Discovery application's

context. WD Discovery version 5.0.589 addresses this issue by disabling certain

features and fuses in Electron. The attack vector for this issue requires the victim to have the WD Discovery app installed on their device.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
EPSS
0.00259 · 16.6th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-08-02T18:31Z
EPSS history
Timeline
  • 02 AUG 18:31Z
    Misconfiguration in node.js causing a code execution in WD Discovery
    cvelistv5