PT-2024-29900

CVE-2024-42366

Published

2024-08-08

Updated

2024-08-29

Description by

CVSS 3.1

9.0

Critical

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VRCX versions prior to 2024.03.23

Description The issue affects VRCX, an assistant/companion application for VRChat. It involves a CefSharp browser with over-permission and cross-site scripting via overlay notification, which can be combined to result in remote command execution.

Recommendations For versions prior to 2024.03.23, update the installation to VRCX 2023.12.24 or later to continue using VRCX, as older versions have been blocked on the VRC's API side.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-269: Improper Privilege Management

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2024-42366