CVE Vulnerability

CVE-2022-39245

Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` binary via the `PATH` variable can allow a local user to run arbitrary commands on the user's system with root permissions. Versions 0.9.5 and later contain a patch. No known workarounds exist.

7.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/makedeb/mist/security/advisories/GHSA-pxg4-7c7r-2ww6 Third Party Advisory
https://github.com/makedeb/mist/commit/e257561a32cffe3c541b265097959adaea3d6b67 Patch Third Party Advisory
https://github.com/makedeb/mist/releases/tag/v0.9.5 Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:makedeb:mist:*:*:*:*:*:*:*:*
Information

Published : 2022-09-26 02:15

Updated : 2022-09-28 07:31

NVD link : CVE-2022-39245

Mitre link : CVE-2022-39245

Products Affected
No products.
CWE
CWE-77