CVE-2023-6319
CVSS V2 None
CVSS V3 None
Description
A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability.
* webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA
* webOS 5.5.0 - 04.50.51 running on OLED55CXPUA
* webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB
* webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA
Overview
- CVE ID
- CVE-2023-6319
- Assigner
- Bitdefender
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-04-09T13:42:06.203Z
- Last Modified Date
- 2024-04-18T07:35:16.311Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/ | |
| https://lgsecurity.lge.com/bulletins/tv#updateDetails | vendor-advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-6319 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6319 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-06-25 06:45:36 | Added to TrackCVE |