CVE-2020-15121

Katalog CVE

CVSS 9.6 · Critical EPSS 1,6%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada radare2, fedoraproject fedora. Skor CVSS 3.1 9.6 (Critical) menurut NVD.

Deskripsi (NVD)

In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the executable in radare2 and run idpd to trigger the download. The shell code will execute, and will create a file called pwned in the current directory.

Rincian

Terbit di NVD

20 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.6 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 74,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/radareorg/radare2/commit/04edfa82c1f3fa2bc3621ccdad2f93bdbf00e4f9 patch · advisory pihak ketiga
• https://github.com/radareorg/radare2/issues/16945 advisory pihak ketiga
• https://github.com/radareorg/radare2/pull/16966 advisory pihak ketiga
• https://github.com/radareorg/radare2/security/advisories/GHSA-r552-vp94-9358 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWC7KNBETYE5M...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YE77P5RSE2T7J...