CVE-2013-4267

Katalog CVE

CVSS 9.8 · Critical EPSS 4,1%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada pydio. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Ajaxeplorer before 5.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) archive_name parameter to the Power FS module (plugins/action.powerfs/class.PowerFSController.php), a (2) file name to the getTrustSizeOnFileSystem function in the File System (Standard) module (plugins/access.fs/class.fsAccessWrapper.php), or the (3) revision parameter to the Subversion Repository module (plugins/meta.svn/class.SvnManager.php).

Rincian

Terbit di NVD

11 Februari 2020

Terakhir diubah

16 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

4,1% peluang dieksploitasi; lebih tinggi dari 90,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pydio/pydio-core/commit/22a62840e5ac14bb389 patch · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2013/08/21/16 mailing list · advisory pihak ketiga
• https://www.tenable.com/plugins/nessus/70495 advisory pihak ketiga