CVE-2024-23749: Command Injection
KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation, failure to escape special characters, and insecure system calls (at lines 2369-2390). This allows an attacker to add inputs inside the filename variable, leading to arbitrary code execution.
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23749?
CVE-2024-23749 is classified as a high severity vulnerability due to the potential for command injection.
How do I fix CVE-2024-23749?
To fix CVE-2024-23749, users should upgrade to KiTTY version 0.76.1.14 or later, which addresses the command injection issue.
What versions of KiTTY are affected by CVE-2024-23749?
KiTTY versions 0.76.1.13 and earlier are affected by CVE-2024-23749.
Who can exploit CVE-2024-23749?
Any attacker with access to the affected KiTTY software can exploit CVE-2024-23749 to execute arbitrary commands.
What causes the vulnerability in CVE-2024-23749?
CVE-2024-23749 is caused by insufficient input sanitization and validation, allowing for command injection via the filename variable.