CVE-2023-47454

HIGH

NetEase CloudMusic 2.10.4 - Untrusted Search Path Privilege Escalation via urlmon.dll

Title source: llm

Description

An Untrusted search path vulnerability in NetEase CloudMusic 2.10.4 for Windows allows local users to gain escalated privileges through the urlmon.dll file in the current working directory.

References (1)

Core 1

Core References

Exploit

https://github.com/xieqiang11/poc-3/tree/main

Scores

CVSS v3 7.8

EPSS 0.0032

EPSS Percentile 23.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-427

Status published

Products (1)

netease/cloudmusic 2.10.4

Published Nov 30, 2023

Tracked Since Feb 18, 2026