CVE-2022-23853
Last modified
CVE-2022-23853 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). EPSS estimates a 0.88% chance of exploitation in the next 30 days.
Description
The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Kde | Kate | < 21.12.2 |
| Kde | Ktexteditor | < 5.91.0 |
References
- https://apps.kde.org/kate/Product, Vendor Advisory
- https://kde.org/info/security/advisory-20220131-1.txtVendor Advisory
- https://apps.kde.org/kate/Product, Vendor Advisory
- https://kde.org/info/security/advisory-20220131-1.txtVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-23853?
How severe is CVE-2022-23853?
How do I fix CVE-2022-23853?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-23848In Alluxio before 2.7.3, the logserver does not validate the…9.8
- CVE-2022-23849The biometric lock in Devolutions Password Hub for iOS befor…6.6
- CVE-2022-2385A security issue was discovered in aws-iam-authenticator whe…8.8
- CVE-2022-23850xhtml_translate_entity in xhtml.c in epub2txt (aka epub2txt2…7.8
- CVE-2022-23851Netaxis API Orchestrator (APIO) before 0.19.3 allows server …9.8
- CVE-2022-23852Expat (aka libexpat) before 2.4.4 has a signed integer overf…9.8
- CVE-2022-23854AVEVA InTouch Access Anywhere versions 2020 R2 and older are…7.5
- CVE-2022-23855An issue was discovered in Saviynt Enterprise Identity Cloud…9.8
- CVE-2022-23856An issue was discovered in Saviynt Enterprise Identity Cloud…5.3
- CVE-2022-23857model/criteria/criteria.go in Navidrome before 0.47.5 is vul…6.5
- CVE-2022-23858A flaw was found in the REST API. An improperly handled REST…8.8
- CVE-2022-2386The Crowdsignal Dashboard WordPress plugin before 3.0.8 does…6.1
Are you affected by CVE-2022-23853?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST