CVE-2023-49314

Publicada em 28 nov 2023 · Atualizada em 26 nov 2024

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 4.3%

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack.

Produtos afetados

n/a · n/a

Referências

https://asana.com/pt/download https://github.com/electron/fuses https://github.com/louiselalanne/CVE-2023-49314 https://github.com/r3ggi/electroniz3r https://www.electronjs.org/blog/statement-run-as-node-cves https://www.electronjs.org/docs/latest/tutorial/fuses