PT-2019-6952 · Red Hat · Zanata

David Jorm · Published 2019-12-03 · Updated 2019-12-05 · CVE-2013-4486

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zanata versions 3.0.0 through 3.1.2

Description The issue is related to Remote Code Execution (RCE) due to EL interpolation in logging.

Recommendations For versions 3.0.0 through 3.1.2, update to a version that fixes the EL interpolation issue in logging to prevent RCE.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2013-4486

Affected Products

Zanata

References · 5

• https://github.com/zanata/zanata-server/wiki/Security-advisories · Patch
• https://access.redhat.com/security/cve/cve-2013-4486 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4486 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4486 · Security Note
• https://t.me/cibsecurity/8467 · Telegram Post