Yüksek CVSS 7.8
CVE-2019-5443: Curl: kod enjeksiyonu
Açıklama (NVD)
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.
Özet bilgiler
- Ürün
- Haxx Curl
- CVSS v3.1
- 7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- %0,69 (yüzdelik 53)
- CWE
- CWE-94
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| haxx-curl | — | 7.65.1 | — |
| oracle-enterprise-manager-ops-center | 12.3.3 | 12.3.3 | — |
| oracle-enterprise-manager-ops-center | 12.4.0 | 12.4.0 | — |
| oracle-http-server | 12.2.1.3.0 | 12.2.1.3.0 | — |
| oracle-http-server | 12.2.1.4.0 | 12.2.1.4.0 | — |
| oracle-mysql-server | 5.0.0 | 5.7.27 | — |
| oracle-mysql-server | 8.0.0 | 8.0.17 | — |
| oracle-oss-support-tools | 20.0 | 20.0 | — |
| netapp-oncommand-insight | — | — | — |
| netapp-oncommand-unified-manager | 7.3 | — | — |
| netapp-oncommand-unified-manager | 9.5 | — | — |
| netapp-oncommand-workflow-automation | — | — | — |
| netapp-snapcenter | — | — | — |