« Volver al listado

CVE-2024-42029

Estado: AplazadaMedia (6.3)—

xdg-desktop-portal-hyprland (aka an XDG Desktop Portal backend for Hyprland) before 1.3.3 allows OS command execution, e.g., because single quotes are not used when sending a list of app IDs and titles via the environment.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Hyprland — HyprlandAIXdg-desktop-portal-hyprland — Xdg-desktop-portal-hyprlandAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-42029",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-42029",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-29T17:12:36.719561Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:xdg:desktop_portal_hyperland:*:*:*:*:*:*:*:*"
          ],
          "vendor": "xdg",
          "product": "desktop_portal_hyperland",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.3.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-07-27T04:15:02.760",
  "references": [
    {
      "url": "https://github.com/hyprwm/xdg-desktop-portal-hyprland/commit/0bb709491baffd69f4f861802f00cf60c77cc2cd",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/hyprwm/xdg-desktop-portal-hyprland/issues/242",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/hyprwm/xdg-desktop-portal-hyprland/releases/tag/v1.3.3",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/hyprwm/xdg-desktop-portal-hyprland/commit/0bb709491baffd69f4f861802f00cf60c77cc2cd",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/hyprwm/xdg-desktop-portal-hyprland/issues/242",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/hyprwm/xdg-desktop-portal-hyprland/releases/tag/v1.3.3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "xdg-desktop-portal-hyprland (aka an XDG Desktop Portal backend for Hyprland) before 1.3.3 allows OS command execution, e.g., because single quotes are not used when sending a list of app IDs and titles via the environment."
    },
    {
      "lang": "es",
      "value": "xdg-desktop-portal-hyprland (también conocido como backend de XDG Desktop Portal para Hyprland) anterior a 1.3.3 permite la ejecución de comandos del sistema operativo, por ejemplo, porque no se utilizan comillas simples al enviar una lista de ID y títulos de aplicaciones a través del entorno."
    }
  ],
  "lastModified": "2026-06-17T07:48:40.157",
  "sourceIdentifier": "cve@mitre.org"
}