← Back to browse · API

CVE-2022-23121

Severity
CRITICAL
CVSS
9.8
EPSS
0.08594
Risk score
42.21
CISA KEV
No
PoC
No
Published
2023-03-28
Modified
2025-11-04
First seen
2026-08-07
Aliases
EUVD-2022-28212, GHSA-8CM2-F4G9-WJFM
Products
Netatalk:Netatalk 3.1.12
Sources
euvd EUVD-2022-28212

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15819.

References