Lucene search

K
ubuntucveUbuntu.comUB:CVE-2023-51698
HistoryJan 12, 2024 - 12:00 a.m.

CVE-2023-51698

2024-01-1200:00:00
ubuntu.com
ubuntu.com
11
atril
document viewer
cve-2023-51698
command injection
vulnerability
tar archive
patch
debian
bug
launchpad
remote code execution
exploit
demo video
unix

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.8%

Atril is a simple multi-page document viewer. Atril is vulnerable to a
critical Command Injection Vulnerability. This vulnerability gives the
attacker immediate access to the target system when the target user opens a
crafted document or clicks on a crafted link/URL using a maliciously
crafted CBT document which is a TAR archive. A patch is available at commit
ce41df6.

Bugs

Notes

Author Note
Priority reason: Remote code execution vulnerability with available exploit and demo video.

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.8%