Lucene search
@huntrdevCVELIST:CVE-2021-3727HistoryNov 30, 2021 - 9:30 a.m.
CVE-2021-3727 OS Command Injection in ohmyzsh/ohmyzsh
2021-11-3009:30:17
CWE-78
@huntrdev
www.cve.org
2
vulnerability
os command injection
ohmyzsh
rand-quote
hitokoto
plugins
quotationspage.com
hitokoto.cn
command injection
external api
fixed
72928432
impacted areas
function
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
9.9
Confidence
High
EPSS
0.002
Percentile
55.6%
Vulnerability in rand-quote and hitokoto plugins Description: the rand-quote and hitokoto fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use print -P to print them. If these quotes contained the proper symbols, they could trigger command injection. Given that they’re an external API, it’s not possible to know if the quotes are safe to use.Fixed in: 72928432.Impacted areas: - rand-quote plugin (quote function). - hitokoto plugin (hitokoto function).
CNA Affected
[
{
"product": "ohmyzsh/ohmyzsh",
"vendor": "ohmyzsh",
"versions": [
{
"lessThan": "72928432",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
]Related
prion
prion
Command injection
2021-11-30 10:15:00
cve
cve
CVE-2021-3727
2021-11-30 10:15:08
osv
osv
CVE-2021-3727
2021-11-30 10:15:08
nvd
nvd
CVE-2021-3727
2021-11-30 10:15:08
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
9.9
Confidence
High
EPSS
0.002
Percentile
55.6%
Related for CVELIST:CVE-2021-3727