Unscored severity · published Apr 20, 1999
CVE-1999-0491
The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute
–
CVSS
0.9%
EPSS
No
On KEV
Description
The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Bash · Gnu
through 2.04; 1.14.0; 1.14.1; 1.14.2; 1.14.3; 1.14.4; +11 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-1999-0491
CVE.org
https://www.cve.org/CVERecord?id=CVE-1999-0491
www.securityfocus.com
http://www.securityfocus.com/bid/119
www.securityfocus.com
http://www.securityfocus.com/templates/archive.pike?list=1&msg=Pine.LNX.4.10.9904202114070.6623-100000%40smooth.Operator.org
More from Bash
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
8.8
CVE-2014-6278
GNU Bash OS Command Injection Vulnerability
8.4
CVE-2016-7543
Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables
7.8
CVE-2022-3715
A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform