CVE-2013-2060 — OS Command Injection in RED HAT Openshift Origin

CWE-78 — OS Command Injection5 documents5 sources
Severity
9.8CRITICALNVD
EPSS
22.0%
top 4.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
RED HAT Openshift OriginRedhat Openshift
Timeline
PublishedJan 28
Latest updateMay 5

Description

The download_from_url function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL of a request to download a cart.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5red_hat/openshift_originunknown

🔴Vulnerability Details

2
GHSA
GHSA-j52h-5vxc-vjgw: The download_from_url function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL of a requ↗2022-05-05
▶
CVEList
CVE-2013-2060: The download_from_url function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL of a requ↗2020-01-28
▶

📋Vendor Advisories

1
Red Hat
OpenShift: Potential remote command execution vulnerability in download cart url↗2013-05-06
▶

💬Community

1
Bugzilla
CVE-2013-2060 OpenShift: Potential remote command execution vulnerability in download cart url↗2013-05-07
▶
CVE-2013-2060 — OS Command Injection in RED | cvebase