CVSS 3.1
8.6 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HCVE-2024-32487
High (8.6). EPSS 0.6% chance of exploitation in the next 30 days.
less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
- CWE
- CWE-96
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- greenwoodsoftware:less
- netapp:bootstrap_os
- netapp:hci_storage_nodes
- netapp:solidfire
References
- http://www.openwall.com/lists/oss-security/2024/04/15/1
- https://github.com/gwsw/less/commit/007521ac3c95bc76e3d59c6dbfe75d06c8075c33
- https://lists.debian.org/debian-lts-announce/2024/05/msg00018.html
- https://security.netapp.com/advisory/ntap-20240605-0009/
- https://www.openwall.com/lists/oss-security/2024/04/12/5