CVE-2019-14868

Katalog CVE

CVSS 7.8 · High EPSS 1,4%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada ksh project ksh, debian linux +1 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.

Rincian

Terbit di NVD

2 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/att/ast/commit/c7de8b641266bac7c77942239ac659edfee9ecd2 patch · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2020/May/53 mailing list · advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14868 issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/07/msg00015.html mailing list · advisory pihak ketiga
• https://support.apple.com/kb/HT211170 advisory pihak ketiga