Unscored severity · published Dec 7, 2013
CVE-2013-4478
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment
–
CVSS
2.1%
EPSS
No
On KEV
Description
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SU
Sup · Supmua
through 0.13.2; 0.13.0; 0.13.1; 0.14.0; 0.14.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4478
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4478
rubyforge.org
http://rubyforge.org/pipermail/sup-talk/2013-August/004993.html
rubyforge.org
http://rubyforge.org/pipermail/sup-talk/2013-October/004996.html
Vendor Advisory
http://secunia.com/advisories/55294
Vendor Advisory
http://secunia.com/advisories/55400
www.debian.org
http://www.debian.org/security/2012/dsa-2805
www.openwall.com
http://www.openwall.com/lists/oss-security/2013/10/30/2
More from Sup
–
CVE-2013-4479
lib/sup/message_chunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the content_type of…