CVE-2022-30580

2022-08-1020:15:40

CWE-94

[email protected]

web.nvd.nist.gov

code injection

os/exec

execution

binaries

working directory

cmd.run

cmd.start

cmd.output

cmd.combinedoutput

cve-2022-30580

go 1.17.11

go 1.18.3

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

14.2%

JSON

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either “…com” or “…exe” by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.