PT-2023-12422 · Zowe Cli+1 · Zowe Cli+1

Andrew Harn + 1 · CVE-2021-4326 · Published 2023-02-22 · Updated 2023-08-08

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Imperative framework (affected versions not specified) Zowe CLI (affected versions not specified)

Description A vulnerability in the Imperative framework allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables.

Recommendations For Imperative framework, restrict access to plugin install/update commands to minimize the risk of exploitation. For Zowe CLI, avoid using maliciously formed environment variables until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-4326

GHSA-6Q8M-42QQ-64R7

Affected Products

Imperative Framework

Zowe Cli

References · 8

• https://osv.dev/vulnerability/GHSA-6q8m-42qq-64r7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4326 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4326 · Vendor Advisory
• https://github.com/zowe/imperative/commits/v5.7.1 · Note
• https://github.com/zowe/imperative/pull/900 · Note
• https://github.com/zowe/imperative/commits/v4.18.10 · Note
• https://github.com/zowe/imperative · Note
• https://github.com/zowe/imperative/pull/902 · Note