PT-2024-4011 · Less+10 · Less+10

Tmarkettos · CVE-2022-48624 · Published 2024-02-18 · Updated 2026-03-05

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: less versions prior to 606

Description: The issue is related to the close altfile function in filename.c, which omits shell quote calls for LESSCLOSE. This can allow an attacker to execute arbitrary commands.

Recommendations: For versions prior to 606, update to version 606 or later to resolve the issue. As a temporary workaround, consider restricting the use of the LESSCLOSE variable to minimize the risk of exploitation.

Exploit

Fix

DoS

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

ALSA-2024:1610

ALSA-2024:1692

ALSA-2024:4256

AZL-34458

BDU:2024-04438

CESA-2024_1610

CESA-2024_4256

CVE-2022-48624

DLA-3823-1

DSA-5679-1

INFSA-2024_4256

OESA-2024-1219

OPENSUSE-SU-2024_1192-1

RHSA-2024:1610

RHSA-2024:1692

RHSA-2024:1875

RHSA-2024:1989

RHSA-2024:4256

RHSA-2024_1610

RHSA-2024_1692

RHSA-2024_4256

RLSA-2024:1610

RLSA-2024:1692

SUSE-SU-2024:1189-1

SUSE-SU-2024:1190-1

SUSE-SU-2024:1192-1

SUSE-SU-2024_1189-1

SUSE-SU-2024_1190-1

SUSE-SU-2024_1192-1

USN-6664-1

USN-8079-1

Affected Products

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Zvirt Node

Less

References · 66

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48624.json · Exploit
• https://github.com/gwsw/less/compare/v605...v606 · Patch
• https://github.com/gwsw/less/commit/c6ac6de49698be84d264a0c4c0c40bb870b10144 · Patch
• https://linux.oracle.com/errata/ELSA-2024-1610.html · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1219 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-34458 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2024:1610 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2024-1610.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48624 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-48624 · Security Note
• https://osv.dev/vulnerability/ALSA-2024:1692 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5679-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04438 · Security Note
• https://osv.dev/vulnerability/ALSA-2024:4256 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1192-1 · Vendor Advisory