CVE-2023-6318
CVSS V2 None
CVSS V3 None
Description
A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability.
Full versions and TV models affected:
* webOS 5.5.0 - 04.50.51 running on OLED55CXPUA
* webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB
* webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA
Overview
- CVE ID
- CVE-2023-6318
- Assigner
- Bitdefender
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-04-09T13:41:47.666Z
- Last Modified Date
- 2024-04-18T07:34:59.024Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/ | |
| https://lgsecurity.lge.com/bulletins/tv#updateDetails | vendor-advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-6318 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6318 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-06-25 07:18:25 | Added to TrackCVE |