Nadesiko3 OS Command Injection vulnerability
Critical severity
GitHub Reviewed
Published
Dec 5, 2022
to the GitHub Advisory Database
•
Updated Jan 31, 2023
Description
Published by the National Vulnerability Database
Dec 5, 2022
Published to the GitHub Advisory Database
Dec 5, 2022
Reviewed
Dec 6, 2022
Last updated
Jan 31, 2023
OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.68 and earlier allows a remote attacker to execute an arbitrary OS command when processing compression and decompression on the product.
Release notes for versions 3.3.62 and 3.3.69 both link to patches for this particular issue. The JPCERT/CC advisory lists versions 3.3.68 and prior as vulnerable, and the most recent patch for this issue is tagged with version 3.3.69.
References