CVE-2024-38395

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2024/06/17/1	Mailing List Third Party Advisory
https://gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219	Patch
https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2	Release Notes
https://iterm2.com/downloads.html	Product
https://www.openwall.com/lists/oss-security/2024/06/15/1	Mailing List
http://www.openwall.com/lists/oss-security/2024/06/17/1	Mailing List Third Party Advisory
https://gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219	Patch
https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2	Release Notes
https://iterm2.com/downloads.html	Product
https://www.openwall.com/lists/oss-security/2024/06/15/1	Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-06-16 01:15

Updated : 2025-06-18 16:40

NVD link : CVE-2024-38395

Mitre link : CVE-2024-38395

CVE.ORG link : CVE-2024-38395

JSON object : View

Products Affected

iterm2

iterm2

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2024-38395", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-06-16T01:15:48.537", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/06/17/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://iterm2.com/downloads.html", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://www.openwall.com/lists/oss-security/2024/06/15/1", "tags": ["Mailing List"], "source": "[email protected]"}, {"url": "http://www.openwall.com/lists/oss-security/2024/06/17/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://iterm2.com/downloads.html", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.openwall.com/lists/oss-security/2024/06/15/1", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "In iTerm2 before 3.5.2, the \"Terminal may report window title\" setting is not honored, and thus remote code execution might occur but \"is not trivially exploitable.\""}, {"lang": "es", "value": "En iTerm2 anterior a 3.5.2, la configuraci\u00f3n \"La terminal puede informar el t\u00edtulo de la ventana\" no se respeta y, por lo tanto, puede ocurrir la ejecuci\u00f3n remota de c\u00f3digo, pero \"no es trivialmente explotable\"."}], "lastModified": "2025-06-18T16:40:48.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53E02516-12F6-4237-819A-08BD2E17DC23", "versionEndExcluding": "3.5.2", "versionStartIncluding": "3.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}