Vulnerability Details : CVE-2020-5253
NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug is patched in NetHack 3.6.0.
Products affected by CVE-2020-5253
- cpe:2.3:a:nethack:nethack:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-5253
0.18%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 41 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-5253
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | |
|
3.9
|
LOW | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N |
0.8
|
2.7
|
GitHub, Inc. |
CWE ids for CVE-2020-5253
-
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.Assigned by: security-advisories@github.com (Secondary)
-
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-5253
-
https://github.com/NetHack/NetHack/security/advisories/GHSA-2c7p-3fj4-223m
NetHack 3.4.3 privilege escalation · Advisory · NetHack/NetHack · GitHubThird Party Advisory
-
https://github.com/NetHack/NetHack/commits/612755bfb5c412079795c68ba392df5d93874ed8
Commits · NetHack/NetHack · GitHubPatch;Third Party Advisory
Jump to