CVE-2024-42366

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-42366", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-07-30T14:01:33.923Z", "datePublished": "2024-08-08T16:51:07.016Z", "dateUpdated": "2024-08-09T18:46:59.693Z"}, "containers": {"cna": {"title": "VR Overlay RCE", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-269", "lang": "en", "description": "CWE-269: Improper Privilege Management", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/vrcx-team/VRCX/security/advisories/GHSA-j98g-mgjm-wqph", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vrcx-team/VRCX/security/advisories/GHSA-j98g-mgjm-wqph"}, {"name": "https://github.com/vrcx-team/VRCX/commit/cd2387aa3289f936ce60049121c24b0765bd4180", "tags": ["x_refsource_MISC"], "url": "https://github.com/vrcx-team/VRCX/commit/cd2387aa3289f936ce60049121c24b0765bd4180"}], "affected": [{"vendor": "vrcx-team", "product": "VRCX", "versions": [{"version": "< 2024.03.23", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-08T16:51:07.016Z"}, "descriptions": [{"lang": "en", "value": "VRCX is an assistant/companion application for VRChat. In versions prior to 2024.03.23, a CefSharp browser with over-permission and cross-site scripting via overlay notification can be combined to result in remote command execution. These vulnerabilities are patched in VRCX 2023.12.24. In addition to the patch, VRCX maintainers worked with the VRC team and blocked the older version of VRCX on the VRC's API side. Users who use the older version of VRCX must update their installation to continue using VRCX."}], "source": {"advisory": "GHSA-j98g-mgjm-wqph", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "vrcx-team", "product": "vrcx", "cpes": ["cpe:2.3:a:vrcx-team:vrcx:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2024.03.23", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-09T18:45:24.020459Z", "id": "CVE-2024-42366", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-09T18:46:59.693Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42366", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-09T18:45:24.020459Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:vrcx-team:vrcx:*:*:*:*:*:*:*:*"], "vendor": "vrcx-team", "product": "vrcx", "versions": [{"status": "affected", "version": "0", "lessThan": "2024.03.23", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-09T18:46:54.894Z"}}], "cna": {"title": "VR Overlay RCE", "source": {"advisory": "GHSA-j98g-mgjm-wqph", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "vrcx-team", "product": "VRCX", "versions": [{"status": "affected", "version": "< 2024.03.23"}]}], "references": [{"url": "https://github.com/vrcx-team/VRCX/security/advisories/GHSA-j98g-mgjm-wqph", "name": "https://github.com/vrcx-team/VRCX/security/advisories/GHSA-j98g-mgjm-wqph", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/vrcx-team/VRCX/commit/cd2387aa3289f936ce60049121c24b0765bd4180", "name": "https://github.com/vrcx-team/VRCX/commit/cd2387aa3289f936ce60049121c24b0765bd4180", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "VRCX is an assistant/companion application for VRChat. In versions prior to 2024.03.23, a CefSharp browser with over-permission and cross-site scripting via overlay notification can be combined to result in remote command execution. These vulnerabilities are patched in VRCX 2023.12.24. In addition to the patch, VRCX maintainers worked with the VRC team and blocked the older version of VRCX on the VRC's API side. Users who use the older version of VRCX must update their installation to continue using VRCX."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269: Improper Privilege Management"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-08T16:51:07.016Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42366", "state": "PUBLISHED", "dateUpdated": "2024-08-09T18:46:59.693Z", "dateReserved": "2024-07-30T14:01:33.923Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-08-08T16:51:07.016Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "VRCX", "vendor": "vrcx-team", "versions": [{"status": "affected", "version": "< 2024.03.23"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:vrcx-team:vrcx:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "vrcx", "vendor": "vrcx-team", "versions": [{"lessThan": "2024.03.23", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vrcx-team:vrcx:*:*:*:*:*:*:*:*", "matchCriteriaId": "62785625-0284-4269-80FD-E36F60B41933", "versionEndExcluding": "2024.03.23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "VRCX is an assistant/companion application for VRChat. In versions prior to 2024.03.23, a CefSharp browser with over-permission and cross-site scripting via overlay notification can be combined to result in remote command execution. These vulnerabilities are patched in VRCX 2023.12.24. In addition to the patch, VRCX maintainers worked with the VRC team and blocked the older version of VRCX on the VRC's API side. Users who use the older version of VRCX must update their installation to continue using VRCX."}, {"lang": "es", "value": "VRCX es una aplicaci\u00f3n asistente/complementaria para VRChat. En versiones anteriores a la 2024.03.23, se puede combinar un navegador CefSharp con permisos excesivos y cross-site scripting mediante notificaci\u00f3n superpuesta para dar como resultado la ejecuci\u00f3n remota de comandos. Estas vulnerabilidades est\u00e1n parcheadas en VRCX 2023.12.24. Adem\u00e1s del parche, los fabricantes de VRCX trabajaron con el equipo de VRC y bloquearon la versi\u00f3n anterior de VRCX en el lado API de VRC. Los usuarios que usan la versi\u00f3n anterior de VRCX deben actualizar su instalaci\u00f3n para continuar usando VRCX."}], "id": "CVE-2024-42366", "lastModified": "2026-06-17T07:49:20.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-42366", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-08-09T18:45:24.020459Z", "version": "2.0.3"}}]}, "published": "2024-08-08T17:15:19.590", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/vrcx-team/VRCX/commit/cd2387aa3289f936ce60049121c24b0765bd4180"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/vrcx-team/VRCX/security/advisories/GHSA-j98g-mgjm-wqph"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-269"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}