CVE-2023-22643

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-22643
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in libzypp-plugin-appdata of SUSE Linux Enterprise Server for SAP 15-SP3; openSUSE Leap 15.4 allows attackers that can trick users to use specially crafted REPO_ALIAS, REPO_TYPE or REPO_METADATA_PATH settings to execute code as root. This issue affects: SUSE Linux Enterprise Server for SAP 15-SP3 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426. openSUSE Leap 15.4 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://bugzilla.suse.com/show_bug.cgi?id=1206836 Exploit Issue Tracking Patch Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1206836 Exploit Issue Tracking Patch Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:opensuse:libzypp-plugin-appdata:*:*:*:*:*:*:*:*
OR cpe:2.3:o:opensuse:leap:15.4:*:*:*:*:*:*:*
cpe:2.3:o:suse:suse_linux_enterprise_server:15:sp3:*:*:*:sap:*:*
History

21 Nov 2024, 07:45

Type Values Removed Values Added
References () https://bugzilla.suse.com/show_bug.cgi?id=1206836 - Exploit, Issue Tracking, Patch, Vendor Advisory () https://bugzilla.suse.com/show_bug.cgi?id=1206836 - Exploit, Issue Tracking, Patch, Vendor Advisory
Summary
  • (es) Una neutralización incorrecta de elementos especiales utilizados en una vulnerabilidad de comando del sistema operativo ('inyección de comando del sistema operativo') en libzypp-plugin-appdata de SUSE Linux Enterprise Server para SAP 15-SP3; openSUSE Leap 15.4 permite a atacantes que pueden engañar a los usuarios utilizar configuraciones REPO_ALIAS, REPO_TYPE o REPO_METADATA_PATH especialmente manipuladas para ejecutar código como root. Este problema afecta a: SUSE Linux Enterprise Server para versiones SAP 15-SP3 libzypp-plugin-appdata anteriores a 1.0.1+git.20180426. Versiones de openSUSE Leap 15.4 libzypp-plugin-appdata anteriores a 1.0.1+git.20180426.
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 6.3
Information

Published : 2023-02-07 10:15

Updated : 2024-11-21 07:45

NVD link : CVE-2023-22643

Mitre link : CVE-2023-22643

CVE.ORG link : CVE-2023-22643

JSON object : View

Products Affected

opensuse

  • leap
  • libzypp-plugin-appdata

suse

  • suse_linux_enterprise_server
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')