Cyber Resilience

CVE-2023-2479

CriticalPublic PoCRCE

Published: 02 May 2023

Published
02 May 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.9273 99.8th percentile
Risk Priority 75 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-2479 is a critical-severity OS Command Injection (CWE-78) vulnerability in Appium Appium-Desktop. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2023-2479 is an OS command injection vulnerability, tracked under CWE-78, that affects the Appium Desktop application in the appium/appium-desktop GitHub repository for all versions prior to 1.22.3-4. The flaw received a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no requirements for authentication or user interaction.

An unauthenticated attacker can supply crafted input that results in arbitrary operating-system command execution on the host running the vulnerable application, granting full control over confidentiality, integrity, and availability of the affected system.

Public references include the fixing commit 12a988aa08b9822e97056a09486c9bebb3aad8fe and the associated huntr.dev bounty report, both of which indicate that upgrading to version 1.22.3-4 or later resolves the issue.

The CVE carries an EPSS score that currently stands at 0.9273 with a recorded peak of 0.9661, indicating sustained and substantial exploitation interest following disclosure.

EU & UK References

Vulnerability details

OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

appium
appium-desktop
≤ 1.22.3-4

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References