7.8

CVE-2023-4736

Exploit

Untrusted Search Path in vim/vim

Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Vim ≫ Vim Version < 9.0.1833
Apple ≫ macOS Version14.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.49% 0.38
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
security@huntr.dev 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-426 Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

http://seclists.org/fulldisclosure/2023/Oct/24
Third Party Advisory
Mailing List
https://support.apple.com/kb/HT213984
Third Party Advisory
Release Notes
https://github.com/vim/vim/commit/816fbcc262687b81fc46f82f7bbeb1453addfe0c
Patch
https://huntr.dev/bounties/e1ce0995-4df4-4dec-9cd7-3136ac3e8e71
Patch
Third Party Advisory
Exploit