CVE-2023-2479
Published: 02 May 2023
Summary
CVE-2023-2479 is a critical-severity OS Command Injection (CWE-78) vulnerability in Appium Appium-Desktop. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-2479 is an OS command injection vulnerability, tracked under CWE-78, that affects the Appium Desktop application in the appium/appium-desktop GitHub repository for all versions prior to 1.22.3-4. The flaw received a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no requirements for authentication or user interaction.
An unauthenticated attacker can supply crafted input that results in arbitrary operating-system command execution on the host running the vulnerable application, granting full control over confidentiality, integrity, and availability of the affected system.
Public references include the fixing commit 12a988aa08b9822e97056a09486c9bebb3aad8fe and the associated huntr.dev bounty report, both of which indicate that upgrading to version 1.22.3-4 or later resolves the issue.
The CVE carries an EPSS score that currently stands at 0.9273 with a recorded peak of 0.9661, indicating sustained and substantial exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1653
Vulnerability details
OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.