NVD

Id
54515  
Name
CVE-2007-2348  
Description
mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script. NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands such as "get" which could overwrite executable files.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2007-04-27  
Modified Date
2013-01-22  
Seq
2007-2348  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
276476 54515 CVE-2007-2348 http://bugs.gentoo.org/show_bug.cgi?id=173524  View
276477 54515 CVE-2007-2348 http://lftp.yar.ru/news.html  View
276478 54515 CVE-2007-2348 oval:org.mitre.oval:def:10806  View
276479 54515 CVE-2007-2348 RHSA-2009:1278  View
276480 54515 CVE-2007-2348 23736  View
276481 54515 CVE-2007-2348 ADV-2007-1590  View
276482 54515 CVE-2007-2348 https://issues.rpath.com/browse/RPL-1229  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
52506 JVNDB-2007-001198 lftp の mirror --script における任意のシェルコマンドを実行される脆弱性 lftp の mirror --script には、シェルのメタ文字を適切にクォートしないため、任意のシェルコマンドを実行される脆弱性が存在します。 CVE-2007-2348 25703 CVE-2007-2348 54515 6.8 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001198.html 2007-04-27 2009-10-09 View