9.3

CVE-2017-12904

Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Newsbeuter ≫ Newsbeuter Version0.7
Newsbeuter ≫ Newsbeuter Version0.8
Newsbeuter ≫ Newsbeuter Version0.8.1
Newsbeuter ≫ Newsbeuter Version0.8.2
Newsbeuter ≫ Newsbeuter Version0.9
Newsbeuter ≫ Newsbeuter Version0.9.1
Newsbeuter ≫ Newsbeuter Version1.0
Newsbeuter ≫ Newsbeuter Version1.1
Newsbeuter ≫ Newsbeuter Version1.2
Newsbeuter ≫ Newsbeuter Version1.3
Newsbeuter ≫ Newsbeuter Version2.0
Newsbeuter ≫ Newsbeuter Version2.1
Newsbeuter ≫ Newsbeuter Version2.2
Newsbeuter ≫ Newsbeuter Version2.3
Newsbeuter ≫ Newsbeuter Version2.4
Newsbeuter ≫ Newsbeuter Version2.5
Newsbeuter ≫ Newsbeuter Version2.6
Newsbeuter ≫ Newsbeuter Version2.7
Newsbeuter ≫ Newsbeuter Version2.8
Newsbeuter ≫ Newsbeuter Version2.9
Debian ≫ Debian Linux Version7.0
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.57% 0.872
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-943 Improper Neutralization of Special Elements in Data Query Logic

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

https://github.com/akrennmair/newsbeuter/issues/591
Third Party Advisory
Issue Tracking