CVE-2023-6319

Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service

State: Published
Severity: 9.1 Critical
Published: Apr 9, 2024
Updated: Aug 2, 2024
Reserved: Nov 27, 2023

Description

A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability.

* webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA

* webOS 5.5.0 - 04.50.51 running on OLED55CXPUA

* webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB

* webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	Bitdefender

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
webOSLG	4.9.7Affected 5.5.0Affected 6.3.3Affected 7.3.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.