PT-2014-1882 · Xmonad · Xmonad-Contrib
Raúl Benencia
·
Publicado
2014-05-28
·
Atualizado
2025-11-14
·
CVE-2013-1436
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
xmonad-contrib versions prior to 0.11.2
Description
The issue allows remote attackers to execute arbitrary commands via a web page title. This can be achieved when the user clicks on the xmobar window title, as demonstrated using an action tag. The XMonad.Hooks.DynamicLog module in xmonad-contrib is affected, potentially leading to disruption of confidentiality, integrity, and availability of protected information.
Recommendations
For versions prior to 0.11.2, update to version 0.11.2 or later to resolve the issue.
As a temporary workaround, consider disabling the XMonad.Hooks.DynamicLog module until a patch is available.
Restrict access to the xmobar window title to minimize the risk of exploitation.
Exploit
Correção
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Xmonad-Contrib