CVE-2019-20807

Katalog CVE

CVSS 5.3 · Medium EPSS 0,49%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada vim, debian linux +5 lainnya. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).

Rincian

Terbit di NVD

28 Mei 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vim/vim/commit/8c62a08faf89663e5633dc5036cd8695c80f1075 patch · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00018.html mailing list · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2020/Jul/24 mailing list · advisory pihak ketiga
• https://github.com/vim/vim/releases/tag/v8.1.0881 release notes · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/01/msg00003.html mailing list · advisory pihak ketiga
• https://support.apple.com/kb/HT211289 advisory pihak ketiga
• https://usn.ubuntu.com/4582-1/ mailing list · advisory pihak ketiga
• https://www.starwindsoftware.com/security/sw-20220812-0003/ advisory pihak ketiga