CVE-2022-24803

2022-04-0100:00:00

ubuntu.com

cve-2022-24803

asciidoctor-include-ext

arbitrary system commands

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

0.004

Percentile

74.9%

JSON

Asciidoctor-include-ext is Asciidoctor’s standard include processor
reimplemented as an extension. Versions prior to 0.4.0, when used to render
user-supplied input in AsciiDoc markup, may allow an attacker to execute
arbitrary system commands on the host operating system. This attack is
possible even when allow-uri-read is disabled! The problem has been
patched in the referenced commits.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009035>

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchruby-asciidoctor-include-ext< anyUNKNOWN
ubuntu22.04noarchruby-asciidoctor-include-ext< anyUNKNOWN
ubuntu24.04noarchruby-asciidoctor-include-ext< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	ruby-asciidoctor-include-ext	< any	UNKNOWN
ubuntu	22.04	noarch	ruby-asciidoctor-include-ext	< any	UNKNOWN
ubuntu	24.04	noarch	ruby-asciidoctor-include-ext	< any	UNKNOWN