CVE-2023-49213 Command injection in n/a

What is CVE-2023-49213?

CVE-2023-49213 is a high-severity command injection vulnerability in n/a, published on 23 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param block is used, due to invalid sanitization of input strings. The fixed versions are 3.10.2, 4.1.10, and 4.2.1.

Weakness: CWE-77

Which versions are affected by CVE-2023-49213?

It affects 1 product.

Products include Ironmansoftware Powershell Universal.

How do I fix CVE-2023-49213?

No fix has been published for CVE-2023-49213 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-49213 being exploited?

There is no known exploitation of CVE-2023-49213 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-45183 Privilege escalation in n/a High 8.8
• CVE-2026-4064 Missing authorization in PowerShell Universal High 8.3
• CVE-2022-45184 Path traversal in n/a High 7.2
• CVE-2026-0618 Cross-site scripting in PowerShell Universal Medium 6.1
• CVE-2026-3563 Denial of service in PowerShell Universal Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-33rj-7vx9-p22p.