Lucene search

GitHub Advisory DatabaseGHSA-3R32-CP7V-5WQ4

HistoryAug 29, 2023 - 12:32 a.m.

Code injection in ansible semaphore

2023-08-2900:32:03

CWE-94

GitHub Advisory Database

github.com

ansible

semaphore

remote attack

code injection

software_security

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

65.0%

JSON

An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter.

Affected configurations

Vulners

Node

github.com\/ansiblesemaphore\/semaphoreRange≤2.8.90

VendorProductVersionCPE
github.com\/ansiblesemaphore\/semaphore*cpe:2.3:a:github.com\/ansible:semaphore\/semaphore:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
github.com\/ansible	semaphore\/semaphore	*	cpe:2.3:a:github.com\/ansible:semaphore\/semaphore::::::::

References

gist.github.com/Alevsk/1757da24c5fb8db735d392fd4146ca3a

github.com/advisories/GHSA-3r32-cp7v-5wq4

nvd.nist.gov/vuln/detail/CVE-2023-39059

www.alevsk.com/2023/07/a-quick-story-of-security-pitfalls-with-execcommand-in-software-integrations/

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

65.0%

JSON

Related for GHSA-3R32-CP7V-5WQ4