CVE-2022-31249 - OpenCVE

A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allows remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Suse	Wrangler

Configuration 1 [-]

OR	cpe:2.3:a:suse:wrangler::::::::
	cpe:2.3:a:suse:wrangler::::::::
	cpe:2.3:a:suse:wrangler:1.0.0:::::::*

References

Link	Resource
https://bugzilla.suse.com/show_bug.cgi?id=1200299	Issue Tracking

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: suse

Published: 2023-02-07T00:00:00

Updated: 2023-02-07T00:00:00

Reserved: 2022-05-20T00:00:00

Link: CVE-2022-31249

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-02-07T13:15:09.537

Modified: 2023-02-15T01:49:20.500

Link: CVE-2022-31249

JSON object: View

Redhat Information

No data.

CWE

CWE-78

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:suse:wrangler:*:*:*:*:*:*:*:*", "matchCriteriaId": "46C3F368-99A7-4B09-B53F-0D57D8E76422", "versionEndExcluding": "0.7.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:wrangler:*:*:*:*:*:*:*:*", "matchCriteriaId": "79667660-A783-43C5-9BD1-6EDBA0B2C61C", "versionEndExcluding": "0.8.5", "versionStartIncluding": "0.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:wrangler:1.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "73F2D72A-9CDA-4823-BA12-0A4468536CFE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allows remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions."}], "id": "CVE-2022-31249", "lastModified": "2023-02-15T01:49:20.500", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "meissner@suse.de", "type": "Secondary"}]}, "published": "2023-02-07T13:15:09.537", "references": [{"source": "meissner@suse.de", "tags": ["Issue Tracking"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1200299"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "meissner@suse.de", "type": "Primary"}]}