org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.
References
| Link | Resource |
|---|---|
| https://list.orgmode.org/tencent_04CF842704737012CCBCD63CD654DD41CA0A@qq.com/T/#m6ef8e7d34b25fe17b4cbb655b161edce18c6655e | Mailing List Patch Vendor Advisory |
| https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=8f8ec2ccf3f5ef8f38d68ec84a7e4739c45db485 | Mailing List Patch |
| https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=a8006ea580ed74f27f974d60b598143b04ad1741 | Mailing List Patch |
Configurations
History
23 Mar 2023, 14:08
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:gnu:org_mode:*:*:*:*:*:gnu_emacs:*:* | |
| CWE | CWE-78 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Gnu
Gnu org Mode |
|
| References | (MISC) https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=8f8ec2ccf3f5ef8f38d68ec84a7e4739c45db485 - Mailing List, Patch | |
| References | (MISC) https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=a8006ea580ed74f27f974d60b598143b04ad1741 - Mailing List, Patch | |
| References | (MISC) https://list.orgmode.org/tencent_04CF842704737012CCBCD63CD654DD41CA0A@qq.com/T/#m6ef8e7d34b25fe17b4cbb655b161edce18c6655e - Mailing List, Patch, Vendor Advisory |
19 Mar 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-19 03:15
Updated : 2023-03-23 14:08
NVD link : CVE-2023-28617
Mitre link : CVE-2023-28617
JSON object : View
Products Affected
gnu
- org_mode
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')