Unscored severity · published Aug 23, 2011
CVE-2011-2649
Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows attackers to execute arbitrary commands via shell metacharacters in an unspecified FileUtils function call
–
CVSS
1.7%
EPSS
No
On KEV
Description
Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows attackers to execute arbitrary commands via shell metacharacters in an unspecified FileUtils function call.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
Kiwi · Marcus Schafer
through 3.74.1 · source: NVD
SS
Suse Studio Onsite · Novell
1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2649
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2649
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00013.html
support.novell.com
http://support.novell.com/security/cve/CVE-2011-2649.html
www.securityfocus.com
http://www.securityfocus.com/bid/49236
bugzilla.novell.com
https://bugzilla.novell.com/show_bug.cgi?id=701815
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/69284
More from Kiwi
–
CVE-2011-2652
Cross-site scripting (XSS) vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via a…
–
CVE-2011-2651
Unspecified vulnerability in the file browser in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted…
–
CVE-2011-2650
Cross-site scripting (XSS) vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via a…
–
CVE-2011-2648
Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a filter in a modified file
–
CVE-2011-2647
Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted archive name in the list…