CVE-2022-44875

KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows attackers to obtain SYSTEM access via KioUtils.Execute in JavaScript code.

Score

CVSS 3.1 5.4 Medium

Status

Modified - cve@mitre.org

Published

2023-03-06

Last modified

2025-03-06

Weaknesses

CWE-79

Affected products

• Kioware (Kioware)

References

• https://github.com/olnor18/writeup/tree/master/CVE/CVE-2022-44875
• https://www.kioware.com/versionhistory.aspx?pid=15