CVE-2011-2649

EPSS 0.43%
Published 23.08.2011 21:55:01
Last modified 11.04.2025 00:51:21
Source cve@mitre.org
Teams watchlist Login
Open Login

Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows attackers to execute arbitrary commands via shell metacharacters in an unspecified FileUtils function call.

Affected products Warnungen 0 Metrics 2 CWE 1 References 8

Data is provided by the National Vulnerability Database (NVD)

Marcus Schafer ≫ Kiwi Version <= 3.74.1

Novell ≫ Suse Studio Onsite Version1.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.43%	0.621

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00013.html

http://www.securityfocus.com/bid/49236

http://support.novell.com/security/cve/CVE-2011-2649.html

https://bugzilla.novell.com/show_bug.cgi?id=701815

https://exchange.xforce.ibmcloud.com/vulnerabilities/69284

https://nvd.nist.gov/vuln/detail/CVE-2011-2649

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2011-2649

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2011-2649

EUVD