Iterm2 CVE-2023-46321

CRITICAL

Improper Output Neutralization for Logs (CWE-117)

2023-10-23 cve@mitre.org

Information Disclosure Iterm2

9.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Oct 23, 2023 - 00:15 nvd

CRITICAL 9.8

DescriptionNVD

iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command line.

AnalysisAI

iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-117. iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command line. Affected products include: Iterm2. Version information: before 3.5.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Iterm2

View all

CVE-2024-38396 CRITICAL Act Now POC

An issue was discovered in iTerm2 3.5.x before 3.5.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely

CVE-2023-46301 CRITICAL Act Now POC

iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences relate

CVE-2023-46300 CRITICAL Act Now POC

iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences relate

CVE-2019-9535 CRITICAL Act Now POC

A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execut

CVE-2015-9231 HIGH This Week POC

iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. Rated high severity (CVSS

CVE-2019-19022 HIGH This Week POC

iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.i

CVE-2024-38395 CRITICAL Act Now

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution mi

CVE-2023-46322 CRITICAL Act Now

iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. Rated critical severity (CV

CVE-2022-45872 CRITICAL Act Now

iTerm2 before 3.4.18 mishandles a DECRQSS response. Rated critical severity (CVSS 9.8), this vulnerability is remotely e

CVE-2026-41253 MEDIUM This Month

Remote code execution in iTerm2 through version 3.6.9 allows local attackers to execute arbitrary code by displaying a s

CVE-2025-22275 CRITICAL This Week

iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from termina

Same weakness CWE-117 – Improper Output Neutralization for Logs

View all

CVE-2024-9606 HIGH POC

CVE-2025-54389 MEDIUM POC

CVE-2024-0987 CRITICAL

CVE-2023-46322 CRITICAL

CVE-2026-1337 MEDIUM POC

CVE-2024-12580 MEDIUM POC

CVE-2025-66577 MEDIUM POC

CVE-2024-31845 MEDIUM POC

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Share

CVE-2023-46321 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy