HSEC-2023-0003
See a problem?- Import Source
- https://github.com/haskell/security-advisories/blob/generated/osv-export/2023/HSEC-2023-0003.json
- JSON Data
- https://api.osv.dev/v1/vulns/HSEC-2023-0003
- Aliases
- Published
- 2023-06-19T21:35:14Z
- Modified
- 2024-07-19T05:20:03.249399Z
- Summary
- code injection in xmonad-contrib
- Details
-
code injection in xmonad-contrib
The
XMonad.Hooks.DynamicLogmodule in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag. - References
Affected packages
Hackage / xmonad-contrib
Package
- Name
- xmonad-contrib
- Purl
- pkg:hackage/xmonad-contrib
Severity
- 7.5 (High) CVSS_V2 - AV:N/AC:L/Au:N/C:P/I:P/A:P CVSS Calculator