CVE-2024-23742

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23742
An issue in Loom on macOS version 0.196.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. NOTE: the vendor disputes this because it requires local access to a victim's machine.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/V3x0r/CVE-2024-23742 Third Party Advisory
https://www.electronjs.org/blog/statement-run-as-node-cves
https://github.com/V3x0r/CVE-2024-23742 Third Party Advisory
https://www.electronjs.org/blog/statement-run-as-node-cves
Configurations

Configuration 1 (hide)

cpe:2.3:a:loom:loom:*:*:*:*:*:macos:*:*
History

21 Nov 2024, 08:58

Type Values Removed Values Added
References () https://github.com/V3x0r/CVE-2024-23742 - Third Party Advisory () https://github.com/V3x0r/CVE-2024-23742 - Third Party Advisory
References () https://www.electronjs.org/blog/statement-run-as-node-cves - () https://www.electronjs.org/blog/statement-run-as-node-cves -

18 Oct 2024, 15:35

Type Values Removed Values Added
CWE CWE-94

01 Mar 2024, 08:15

Type Values Removed Values Added
Summary (en) An issue in Loom on macOS version 0.196.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. (en) An issue in Loom on macOS version 0.196.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. NOTE: the vendor disputes this because it requires local access to a victim's machine.

16 Feb 2024, 16:15

Type Values Removed Values Added
References
  • () https://www.electronjs.org/blog/statement-run-as-node-cves -

01 Feb 2024, 21:08

Type Values Removed Values Added
First Time Loom
Loom loom
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CPE cpe:2.3:a:loom:loom:*:*:*:*:*:macos:*:*
References () https://github.com/V3x0r/CVE-2024-23742 - () https://github.com/V3x0r/CVE-2024-23742 - Third Party Advisory
CWE NVD-CWE-noinfo

28 Jan 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-28 03:15

Updated : 2024-11-21 08:58

NVD link : CVE-2024-23742

Mitre link : CVE-2024-23742

CVE.ORG link : CVE-2024-23742

JSON object : View

Products Affected

loom

  • loom
CWE
NVD-CWE-noinfo CWE-94

Improper Control of Generation of Code ('Code Injection')