CVE-2023-46502: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

October 31, 2023 (updated November 1, 2023)

An issue in OpenCRX v.5.2.2 allows a remote attacker to execute arbitrary code via a crafted request.

References

gist.github.com/spookhorror/9519fc66d3946e887e4a86c06ddbee0e
github.com/advisories/GHSA-q74f-rf27-8hxc
github.com/opencrx/opencrx/commit/ce7a71db0bb34ecbcb0e822d40598e410a48b399
nvd.nist.gov/vuln/detail/CVE-2023-46502

Code Behaviors & Features

Detect and mitigate CVE-2023-46502 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →