CVE-2020-15167: johnkerl miller

csirt@kutim:~/threat-intel/cve/CVE-2020-15167

CVSS 8.6 · High EPSS 0,43%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada johnkerl miller. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitrary code by placing a malicious `.mlrrc` file in the working directory. See linked GitHub Security Advisory for complete details. A fix is ready and will be released as Miller 5.9.1.

Rincian

Terbit di NVD: 2 September 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.6 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-427: Uncontrolled Search Path Element
EPSS (30 hari): 0,43% peluang dieksploitasi; lebih tinggi dari 35,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
johnkerl	miller	Versi 5.9.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/johnkerl/miller/security/advisories/GHSA-mw2v-4q78-j2cw exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.