CVE-2024-38395: Code Injection
Published Jun 16, 2024
·Updated
In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."
Affected Software
2 affected components
iTerm2 iTerm2<3.5.2
iTerm2 iTerm2>=3.5.0<3.5.2
Remediation
Event History
Jun 16, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·01:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-38395?
CVE-2024-38395 is considered a moderate severity vulnerability due to the potential for remote code execution, though it is not trivially exploitable.
2
How do I fix CVE-2024-38395?
To fix CVE-2024-38395, users should upgrade to iTerm2 version 3.5.2 or later.
3
What systems are affected by CVE-2024-38395?
CVE-2024-38395 affects iTerm2 versions prior to 3.5.2.
4
Can CVE-2024-38395 be exploited remotely?
Yes, CVE-2024-38395 allows for potential remote code execution, but it requires specific conditions that make it not trivially exploitable.
5
Is there a patch available for CVE-2024-38395?
Yes, a patch is available in the form of an upgrade to iTerm2 version 3.5.2.