CVE-2023-6319: Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service
A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability.
webOS 4.9.7 - 5.30.40 running on LG43UM7000PLA
webOS 5.5.0 - 04.50.51 running on OLED55CXPUA
webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB
webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6319?
The severity of CVE-2023-6319 is high, as it allows for command execution as the root user.
How do I fix CVE-2023-6319?
To fix CVE-2023-6319, update your LG webOS device to the latest version that addresses this vulnerability.
Which versions of LG webOS are affected by CVE-2023-6319?
CVE-2023-6319 affects LG webOS versions 4.0 through 7.0.
What type of vulnerability is CVE-2023-6319?
CVE-2023-6319 is classified as a command injection vulnerability.
Can CVE-2023-6319 lead to unauthorized access?
Yes, CVE-2023-6319 can lead to unauthorized access, allowing an attacker to execute commands as the root user.