exploitDog

CVE-2014-3486

Опубликовано: 30 июн. 2014

Источник: redhat

CVSS2: 6.9

EPSS Низкий

Описание

The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.

Ссылки на источники

https://www.cve.org/CVERecord?id=CVE-2014-3486
https://nvd.nist.gov/vuln/detail/CVE-2014-3486

Дополнительная информация

Статус:

Important

Дефект:

CWE-377

https://bugzilla.redhat.com/show_bug.cgi?id=1107528CFME: SSH Utility insecure tmp file creation leading to code execution as root

EPSS

Процентиль: 28%

0.00354

Низкий

6.9 Medium

CVSS2

Связанные уязвимости

CVE-2014-3486

nvd

около 12 лет назад

The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.

GHSA-4r83-3x2w-gg64

github

около 4 лет назад

The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.

EPSS

Процентиль: 28%

0.00354

Низкий

6.9 Medium

CVSS2