CVE-2023-46300 - Vulnerability Details - OpenCVE

ReportizFlow

iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integration.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Iterm2	Iterm2

Configuration 1 [-]

cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://blog.solidsnail.com/posts/2023-08-28-iterm2-rce
https://github.com/gnachman/iTerm2/commit/ae8192522661c34d1cbe57f6f9ef2ff0a337c2a5
https://github.com/gnachman/iTerm2/commit/b2268b03b5f3d4cd8ca275eaef5d16d0fac20009
https://iterm2.com/news.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-10-22T00:00:00.000Z

Updated: 2024-09-12T17:49:38.677Z

Reserved: 2023-10-22T00:00:00.000Z

Link: CVE-2023-46300

Vulnrichment

Updated: 2024-08-02T20:45:40.846Z

NVD

Status : Modified

Published: 2023-10-22T04:15:09.740

Modified: 2026-06-17T06:30:36.743

Link: CVE-2023-46300

Redhat

No data.

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "[email protected]"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE5A8378-60FE-4F69-A7AA-DEE9393C51C8", "versionEndExcluding": "3.4.20", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integration."}, {"lang": "es", "value": "iTerm2 anterior a 3.4.20 permite la ejecuci\u00f3n de c\u00f3digo (potencialmente remota) debido al mal manejo de ciertas secuencias de escape relacionadas con la integraci\u00f3n de tmux."}], "id": "CVE-2023-46300", "lastModified": "2026-06-17T06:30:36.743", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-46300", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-09-12T17:49:29.200906Z", "version": "2.0.3"}}]}, "published": "2023-10-22T04:15:09.740", "references": [{"source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.solidsnail.com/posts/2023-08-28-iterm2-rce"}, {"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/gnachman/iTerm2/commit/ae8192522661c34d1cbe57f6f9ef2ff0a337c2a5"}, {"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/gnachman/iTerm2/commit/b2268b03b5f3d4cd8ca275eaef5d16d0fac20009"}, {"source": "[email protected]", "tags": ["Release Notes"], "url": "https://iterm2.com/news.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.solidsnail.com/posts/2023-08-28-iterm2-rce"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/gnachman/iTerm2/commit/ae8192522661c34d1cbe57f6f9ef2ff0a337c2a5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/gnachman/iTerm2/commit/b2268b03b5f3d4cd8ca275eaef5d16d0fac20009"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://iterm2.com/news.html"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "[email protected]", "type": "Primary"}]}