CVE-2018-10895

Опубликовано: 12 июл. 2018

Источник: nvd

CVSS3: 9.3

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. A malicious website could exploit this to load a 'qute://settings/set' URL, which then sets 'editor.command' to a bash script, resulting in arbitrary code execution.

Ссылки

http://www.openwall.com/lists/oss-security/2018/07/11/7
Mailing List
Mitigation
Patch
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10895
Issue Tracking
Patch
Third Party Advisory
https://github.com/qutebrowser/qutebrowser/commit/43e58ac865ff862c2008c510fc5f7627e10b4660
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2018/07/11/7
Mailing List
Mitigation
Patch
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10895
Issue Tracking
Patch
Third Party Advisory
https://github.com/qutebrowser/qutebrowser/commit/43e58ac865ff862c2008c510fc5f7627e10b4660
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:qutebrowser:qutebrowser:*:*:*:*:*:*:*:*

Версия до 1.4.1 (исключая)

EPSS

Процентиль: 38%

0.00169

Низкий

9.3 Critical

CVSS3

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

CVE-2018-10895

CVSS3: 9.3

ubuntu

больше 7 лет назад

CVE-2018-10895

CVSS3: 9.3

debian

больше 7 лет назад

qutebrowser before version 1.4.1 is vulnerable to a cross-site request ...

GHSA-wgmx-52ph-qqcw

CVSS3: 8.8

github

больше 7 лет назад

Qutebrowser CSRF Vulnerability

openSUSE-SU-2018:2120-1

suse-cvrf

больше 7 лет назад

Security update for qutebrowser

EPSS

Процентиль: 38%

0.00169

Низкий

9.3 Critical

CVSS3

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352