CVE-2023-34634
GreenShot 1.2.10 - Insecure Deserialization Arbitrary Code Execution
Severity Score
7.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
3
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .greenshot file is opened.
Greenshot 1.2.10 y versiones anteriores permiten la ejecución de código arbitrario porque el contenido .NET se deserializa de forma insegura cuando se abre un archivo .greenshot.
There exists a .NET deserialization vulnerability in Greenshot versions 1.3.274 and below. The deserialization allows the execution of commands when a user opens a Greenshot file. The commands execute under the same permissions as the Greenshot service. Typically, it is the logged in user.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-06-07 CVE Reserved
- 2023-07-31 CVE Published
- 2023-08-18 First Exploit
- 2024-09-02 EPSS Updated
- 2024-10-23 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/174222/Greenshot-1.3.274-Deserialization-Command-Execution.html |
|
|
| https://greenshot.atlassian.net/browse/BUG-3061 | Third Party Advisory | |
| - |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/51633 | 2024-10-23 | |
| https://github.com/radman404/CVE-2023-34634 | 2023-08-18 | |
| http://packetstormsecurity.com/files/173825/GreenShot-1.2.10-Arbitrary-Code-Execution.html | 2024-10-23 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/greenshot/greenshot/commit/a152e2883fca7f78051b3bd6b1e5cc57355cb44c | 2023-08-17 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Greenshot Search vendor "Greenshot" | Greenshot Search vendor "Greenshot" for product "Greenshot" | <= 1.2.10 Search vendor "Greenshot" for product "Greenshot" and version " <= 1.2.10" | - |
Affected
| ||||||