Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

CVE-2017-17520

🗓️ 14 Dec 2017 16:00:00Reported by mitreType 
cve
 cve🔗 web.nvd.nist.gov👁 57 Views🌐 WEB

tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL

Related
Detection
Refs
Paths
ReporterTitlePublishedViews
Family
CNVD		TIN Parameter Injection Vulnerability
11 Jun 201800:00
–cnvd
Cvelist		CVE-2017-17520
14 Dec 201716:00
–cvelist
Debian CVE		CVE-2017-17520
14 Dec 201716:00
–debiancve
NVD		CVE-2017-17520
14 Dec 201716:29
–nvd
OSV		CVE-2017-17520
14 Dec 201716:29
–osv
OSV		UBUNTU-CVE-2017-17520
14 Dec 201716:29
–osv
Prion		Design/Logic Flaw
14 Dec 201716:29
–prion
Positive Technologies		PT-2017-14831 · Tin +2 · Tin +2
14 Dec 201700:00
–ptsecurity
RedhatCVE		CVE-2017-17520
20 May 202223:37
–redhatcve
SUSE CVE		SUSE CVE-2017-17520
15 Feb 202304:36
–susecve
Rows per page
NVD
Vulnrichment
Node
debiantinMatch2.4.1
ParameterPositionPathDescriptionCWE
BROWSER environment variablepathtools/url_handler.plURL handler does not validate strings before launching the program specified by the BROWSER environment variable, enabling argument-injection via crafted URLs.CWE-74
URL passed to url_handler.plpathtools/url_handler.plURL handler does not validate strings before launching the program specified by the BROWSER environment variable, enabling argument-injection via crafted URLs.CWE-74

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
13 May 2026 00:24Current
8.5High risk
Vulners AI Score8.5
CVSS 26.8
CVSS 38.8
CVSS 3.18.8
EPSS0.00534
SSVC
CWE-74
cve-2017-17520tin 2.4.1securityvalidationremote attackersargument-injectioncrafted urlnvd
57