CVE-2023-49314

Published November 28th, 2023

View on NVD ↗

CVSS v3

7.8

HIGH

CVSS v2

N/A

Affected

PROJECTS

Description

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack.

r3ggi/electroniz3r

Take over macOS Electron apps' TCC permissions

GitHub

223

louiselalanne/CVE-2023-49314

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and enableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack.

GitHub

electron/fuses

GitHub