Unscored severity · published Jul 9, 2013
CVE-2013-1362
Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell…
–
CVSS
65.7%
EPSS
No
On KEV
Description
Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters, which are processed by bash.
Exploitation
Is it being used?
Exploit prediction (EPSS)65.7% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opensuse · Opensuse
11.4; 12.1; 12.2 · source: NVD
RP
Remote Plug IN Executor · Nagios
through 2.13; 1.3; 1.4; 1.5; 1.6; 1.7; +23 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1362
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1362
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00005.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00006.html
seclists.org
http://seclists.org/bugtraq/2013/Feb/119
www.exploit-db.com
http://www.exploit-db.com/exploits/24955
www.occamsec.com
http://www.occamsec.com/vulnerabilities.html#nagios_metacharacter_vulnerability
bugzilla.novell.com
https://bugzilla.novell.com/show_bug.cgi?id=807241
More from Remote Plug IN Executor
7.5
CVE-2020-6582
Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call
7.3
CVE-2020-6581
Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sequence)