PT-2023-16660 · Trellix · Trellix Intelligent Sandbox Cli

Derrick Berg · Publicado 2023-03-13 · Atualizado 2023-03-17 · CVE-2023-0978

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trellix Intelligent Sandbox CLI versions 5.2 and earlier

Description A command injection issue allows a local user to inject and execute arbitrary operating system commands using specially crafted strings. This is due to insufficient validation of arguments passed to specific CLI commands.

Recommendations For versions 5.2 and earlier, update to a version later than 5.2 to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable CLI command to minimize the risk of exploitation. Avoid using specially crafted strings in CLI commands until the issue is resolved.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2023-0978

Produtos afetados

Trellix Intelligent Sandbox Cli

Referências · 4

• https://osv.dev/vulnerability/CVE-2023-0978 · Aviso do Fabricante
• https://kcm.trellix.com/corporate/index?page=content&id=SB10397 · Aviso do Fabricante
• https://t.me/cibsecurity/59897 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0978 · Nota de Segurança