CVE-2022-45639

Опубликовано: 24 янв. 2023

Источник: nvd

CVSS3: 7.8

EPSS Низкий

Описание

OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the backtick command executes outside the context of the user account that entered the command line.

Ссылки

http://packetstormsecurity.com/files/171649/Sleuthkit-4.11.1-Command-Injection.html
http://www.binaryworld.it/
Exploit
Vendor Advisory
https://www.binaryworld.it/guidepoc.asp#CVE-2022-45639
Broken Link
http://packetstormsecurity.com/files/171649/Sleuthkit-4.11.1-Command-Injection.html
http://www.binaryworld.it/
Exploit
Vendor Advisory
https://www.binaryworld.it/guidepoc.asp#CVE-2022-45639
Broken Link

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sleuthkit:the_sleuth_kit:4.11.1:*:*:*:*:*:*:*

EPSS

Процентиль: 92%

0.04709

Низкий

7.8 High

CVSS3

Дефекты

CWE-78

Связанные уязвимости

CVE-2022-45639

CVSS3: 7.8

msrc

около 1 года назад

CVE-2022-45639

CVSS3: 7.8

debian

почти 4 года назад

OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows ...

GHSA-v833-mfjc-7qr5

CVSS3: 9.8

github

почти 4 года назад

OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter.

ALT-PU-2023-1421

CVSS3: 7.8

altlinux

больше 3 лет назад

ALT-PU-2023-1421: package `sleuthkit` update to version 4.12.0-alt1

EPSS

Процентиль: 92%

0.04709

Низкий

7.8 High

CVSS3

Дефекты

CWE-78