PT-2023-12422 · Zowe Cli+1 · Zowe Cli+1

Andrew Harn + 1 · Publicado 2023-02-22 · Atualizado 2023-08-08 · CVE-2021-4326

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Imperative framework (affected versions not specified) Zowe CLI (affected versions not specified)

Description A vulnerability in the Imperative framework allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables.

Recommendations For Imperative framework, restrict access to plugin install/update commands to minimize the risk of exploitation. For Zowe CLI, avoid using maliciously formed environment variables until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2021-4326

GHSA-6Q8M-42QQ-64R7

Produtos afetados

Imperative Framework

Zowe Cli

Referências · 8

• https://github.com/zowe/imperative/commits/v5.7.1 · Nota
• https://github.com/zowe/imperative/pull/900 · Nota
• https://github.com/zowe/imperative/commits/v4.18.10 · Nota
• https://github.com/zowe/imperative · Nota
• https://github.com/zowe/imperative/pull/902 · Nota
• https://osv.dev/vulnerability/GHSA-6q8m-42qq-64r7 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2021-4326 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2021-4326 · Aviso do Fabricante