What’s Vulnerable › Vulnerabilities

CVE-2023-42222

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-09-28 · updated 2026-06-17

Description

WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.

Affected products

• Webcatalog: before 49.0 — fixed in 49.0

How to fix

Upgrade to a fixed version: Webcatalog 49.0. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/176957/WebCatalog-48.4-Arbitrary-Protocol-Execution-Code-Execution.html
• https://github.com/itssixtyn3in/CVE-2023-42222
• https://webcatalog.io/changelog/
• https://www.electronjs.org/docs/latest/tutorial/security#15-do-not-use-shellopenexternal-with-untrusted-content
• http://packetstormsecurity.com/files/176957/WebCatalog-48.4-Arbitrary-Protocol-Execution-Code-Execution.html
• https://github.com/itssixtyn3in/CVE-2023-42222
• https://webcatalog.io/changelog/
• https://www.electronjs.org/docs/latest/tutorial/security#15-do-not-use-shellopenexternal-with-untrusted-content

Get alerted when CVE-2023-42222 or the next vulnerability affects your stack