Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-g527-g4q2-57xc

Опубликовано: 24 дек. 2021
Источник: github
Github: Не прошло ревью
CVSS3: 8.8

Описание

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

EPSS

Процентиль: 64%
0.00478
Низкий

8.8 High

CVSS3

Дефекты

CWE-77
CWE-78

Связанные уязвимости

CVSS3: 8.8
ubuntu
больше 3 лет назад

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS3: 6.7
redhat
почти 4 года назад

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS3: 8.8
nvd
больше 3 лет назад

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS3: 8.8
debian
больше 3 лет назад

A flaw was found in SSSD, where the sssctl command was vulnerable to s ...

suse-cvrf
почти 4 года назад

Security update for sssd

EPSS

Процентиль: 64%
0.00478
Низкий

8.8 High

CVSS3

Дефекты

CWE-77
CWE-78