CVE-2017-12904

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-12904
Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://www.debian.org/security/2017/dsa-3947 Third Party Advisory
https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307 Patch Third Party Advisory
https://github.com/akrennmair/newsbeuter/issues/591 Issue Tracking Third Party Advisory
https://groups.google.com/forum/#%21topic/newsbeuter/iFqSE7Vz-DE
https://usn.ubuntu.com/4585-1/
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:newsbeuter:newsbeuter:0.7:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:0.8:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:0.8.1:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:0.8.2:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:0.9:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:0.9.1:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:1.0:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:1.1:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:1.2:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:1.3:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:2.0:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:2.1:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:2.2:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:2.3:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:2.4:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:2.5:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:2.6:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:2.7:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:2.8:*:*:*:*:*:*:*
cpe:2.3:a:newsbeuter:newsbeuter:2.9:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
History

07 Nov 2023, 02:38

Type Values Removed Values Added
References
  • {'url': 'https://groups.google.com/forum/#!topic/newsbeuter/iFqSE7Vz-DE', 'name': '[newsbeuter] 20170817 [CVE-2017-12904] Remote code execution', 'tags': ['Patch', 'Third Party Advisory'], 'refsource': 'MLIST'}
  • () https://groups.google.com/forum/#%21topic/newsbeuter/iFqSE7Vz-DE -
Information

Published : 2017-08-23 14:29

Updated : 2023-12-10 12:15

NVD link : CVE-2017-12904

Mitre link : CVE-2017-12904

CVE.ORG link : CVE-2017-12904

JSON object : View

Products Affected

debian

  • debian_linux

newsbeuter

  • newsbeuter
CWE
CWE-943

Improper Neutralization of Special Elements in Data Query Logic