CVE-2022-23609 Path traveresal in iTunesRPC-Remastered
An attacker can delete arbitrary files on the victim's system by exploiting unsanitized input in the iTunesRPC-Remastered utility.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-23609?
CVE-2022-23609 is a high-severity path traversal vulnerability in bildsben iTunesRPC-Remastered, published on 4 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input used to remove files leading to file deletion only limited by the process permissions. Users are advised to upgrade as soon as possible.
Weakness: CWE-22
Which versions are affected by CVE-2022-23609?
It affects 1 product.
Products include Itunesrpc-Remastered Project Itunesrpc-Remastered.
How do I fix CVE-2022-23609?
No fix has been published for CVE-2022-23609 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-23609 being exploited?
There is no known exploitation of CVE-2022-23609 in the wild and no public exploit code.
Other vulnerabilities in bildsben iTunesRPC-Remastered
Sources
Also known as GHSA-cc8j-fr7v-7r6q.