CVE-2022-39245
High
Description
Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` binary via the `PATH` variable can allow a local user to run arbitrary commands on the user's system with root permissions. Versions 0.9.5 and later contain a patch. No known workarounds exist.
SeverityHigh
CVSS8.4
Exploit probability—
ProductMakedeb Mist
PublishedSep 26, 2022
First seenSep 26, 2022
Weakness typeCWE-305CWE-305CWE-287Improper authentication
How to fix
Update
- makedeb mist0.9.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| makedeb mist | v < 0.9.5 | 0.9.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.