CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
41.4%
In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing
allows command injection via shell metacharacters in a JSON configuration
request received via 127.0.0.1 UDP traffic, related to the add_server,
build_config, and construct_command_line functions.
openwall.com/lists/oss-security/2017/10/13/2
github.com/shadowsocks/shadowsocks-libev/commit/c67d275
github.com/shadowsocks/shadowsocks-libev/issues/1734
launchpad.net/bugs/cve/CVE-2017-15924
nvd.nist.gov/vuln/detail/CVE-2017-15924
security-tracker.debian.org/tracker/CVE-2017-15924
www.cve.org/CVERecord?id=CVE-2017-15924
www.x41-dsec.de/lab/advisories/x41-2017-010-shadowsocks-libev/
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
41.4%