PT-2022-12433 · Freecad · Freecad

Eldstal · Published 2022-01-25 · Updated 2022-10-27 · CVE-2021-45845

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeCAD version 0.19

Description The Path Sanity Check script is vulnerable to OS command injection, allowing an attacker to execute arbitrary commands via a crafted FCStd document.

Recommendations For FreeCAD version 0.19, consider disabling the Path Sanity Check script until a patch is available to prevent OS command injection attacks.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-45845

DSA-5229-1

Affected Products

Freecad

References · 13

• 🔥 https://tracker.freecad.org/view.php?id=4810 · Exploit
• https://github.com/FreeCAD/FreeCAD/pull/5306 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-45845 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45845 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45845 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-45845 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-45845 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5229-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-45845 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-45845 · Vendor Advisory
• https://debian.org/security/2022/dsa-5229 · Vendor Advisory
• https://t.me/cibsecurity/36204 · Telegram Post
• https://t.me/cvenotify/26119 · Telegram Post