Vulnerability Details : CVE-2013-2208
tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file.
Products affected by CVE-2013-2208
- cpe:2.3:a:andreas_krennmair:tpp:1.3.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-2208
0.61%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 67 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2013-2208
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2013-2208
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-2208
-
https://github.com/akrennmair/tpp/pull/2
[CVE-2013-2208] Don't execute commands with --exec by default by xtaran · Pull Request #2 · akrennmair/tpp · GitHub
-
http://www.openwall.com/lists/oss-security/2013/06/21/4
oss-security - Re: CVE Request -- tpp: Possibility of arbitrary code execution when processing untrusted TPP template
-
http://security.gentoo.org/glsa/glsa-201309-19.xml
TPP: User-assisted execution of arbitrary code (GLSA 201309-19) — Gentoo security
-
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706644
#706644 - tpp: [CVE-2013-2208] untrusted input file might be harmful - Debian Bug report logs
Jump to