cve.bz

CWE-88: Improper Neutralization of Argument Delimiters in a Command (Argument Injection), page 8

Filter

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

What the weakness is: CWE-88 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 5
  • CAPEC-41 Using Meta-characters in E-mail Headers to Inject Malicious Payloads Likelihood: High · Severity: High
  • CAPEC-88 OS Command Injection Likelihood: High · Severity: High
  • CAPEC-137 Parameter Injection Likelihood: Medium · Severity: Medium
  • CAPEC-174 Flash Parameter Injection Likelihood: High · Severity: Medium
  • CAPEC-460 HTTP Parameter Pollution (HPP) Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-88, as MITRE names them. Credits.

Ask an AI about CWE-88

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-88: Improper Neutralization of Argument Delimiters in a Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/88.html and https://cve.bz/cve/cwe/88?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.1CVE-2022-1399EPSS 1.0%

    An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMDB allows a local attacker to run arbitrary code on the appliance with root privileges. This issue a…

  2. 7.5CVE-2022-37005EPSS 0.6%

    The Settings application has an argument injection vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.

  3. 7.8CVE-2022-25973EPSS 0.5%

    All versions of package mc-kill-port are vulnerable to Arbitrary Command Execution via the kill function, due to missing sanitization of the port argument.

  4. 8.8CVE-2022-36322EPSS 0.7%

    In JetBrains TeamCity before 2022.04.2 build parameter injection was possible

  5. 6.5CVE-2019-10800EPSS 1.2%

    This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.

  6. 9.8CVE-2022-25900EPSS 3.9%

    All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the --upload-pack feature of git.

  7. 8.1CVE-2022-31084EPSS 2.5%

    LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker c…

  8. 5.5CVE-2022-31246EPSS 0.8%

    paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data). On Windows, this can lead to capture of credentials over SMB. On Linux and UNIX, it can lead to a denial o…

  9. 9.8CVE-2022-24376EPSS 2.9%

    All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SNYK-JS-GITPROMISE-567476) in this package. **Note:** Please note that the vulnera…

  10. 9.1CVE-2021-33473EPSS 1.1%

    An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.

  11. 7.8CVE-2022-26532EPSS 4.8%

    A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN s…

  12. 7.5CVE-2022-29215EPSS 1.2%

    RegionProtect is a plugin that allows users to manage certain events in certain regions of the world. Versions prior to 1.1.0 contain a YAML injection vulnerability that can cause an instant server crash if the passed arguments are not mat…

  13. 8.8CVE-2022-29184EPSS 3.6%

    GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create pipeline materials or pipeline configuration repositories to get remote code exe…

  14. 9.8CVE-2022-25865EPSS 6.7%

    The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch(remote: string, remoteBranch: string, cwd: string) function, both the remote and remoteBranch para…

  15. 7.8CVE-2022-30240EPSS 0.5%

    An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift JDBC Driver 1.2.40 through 1.2.55 may allow a local user to execute code. NOTE: this is different from CVE-2022-29972.

  16. 7.8CVE-2022-30239EPSS 0.5%

    An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena JDBC Driver 2.0.25 through 2.0.28 may allow a local user to execute code. NOTE: this is different from CVE-2022-29971.

  17. 7.8CVE-2022-29972EPSS 3.7%

    An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver (1.4.14 through 1.4.21.1001 and 1.4.22 through 1.4.x before 1.4.52) may allow a local user to execute arbi…

  18. 7.8CVE-2022-29971EPSS 0.4%

    An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena ODBC Driver 1.1.1 through 1.1.x before 1.1.17 may allow a local user to execute arbitrary code.

  19. 9.8CVE-2022-30284EPSS 5.5%

    In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments). NOTE: the vendor believes it would be unrealistic for an application to call Nma…

  20. 9.8CVE-2022-24437EPSS 3.7%

    The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). H…

  21. 9.8CVE-2022-25866EPSS 3.6%

    The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-r…

  22. 9.8CVE-2022-25648EPSS 4.9%

    The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additiona…

  23. 8.8CVE-2022-24828EPSS 1.9%

    Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. T…

  24. 8.8CVE-2022-28391EPSS 3.5%

    BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.

  25. 9.8CVE-2022-24066EPSS 3.9%

    The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar…

  26. 9.8CVE-2022-24440EPSS 2.6%

    The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch …

  27. 9.8CVE-2022-21223EPSS 1.7%

    The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a …

  28. 9.8CVE-2022-21235EPSS 1.6%

    The package github.com/masterminds/vcs before 1.13.3 are vulnerable to Command Injection via argument injection. When hg is executed, argument strings are passed to hg in a way that additional flags can be set. The additional flags can be …

  29. 9.8CVE-2021-43736EPSS 2.5%

    CmsWing CMS 1.3.7 is affected by a Remote Code Execution (RCE) vulnerability via parameter: log rule

  30. 8.8CVE-2022-25766EPSS 35%

    The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values (remote and ref) are passed to the git fetch command. By in…

  31. 9.8CVE-2022-21187EPSS 3.6%

    The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was po…

  32. 9.8CVE-2022-24433EPSS 3.7%

    The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By i…

  33. 8.8CVE-2022-23915EPSS 3.1%

    The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended wa…

  34. 5.3CVE-2022-24953EPSS 0.9%

    The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.

  35. 9.8CVE-2022-23221EPSS 65%

    H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-4239…

  36. 7.3CVE-2021-43809EPSS 2.9%

    `Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, un…

  37. 9.8CVE-2021-37040EPSS 0.8%

    There is a Parameter injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause privilege escalation of files after CIFS share mounting.

  38. 8.8CVE-2021-41146EPSS 1.5%

    qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a `qutebrowserurl:` URL handler. With certain applications, opening a specially cr…

  39. 8.8CVE-2021-38112EPSS 7.5%

    In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows, argument injection in the workspaces:// URI handler can lead to remote code execution because of the Chromium Embedded Framework (CEF) --gpu-launcher argument. This is fi…

  40. 8.1CVE-2021-41316EPSS 1.4%

    The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (with permissions to add or edit jobs run by this utility) can inject an extra argument to overwrite arbitrary files as the…

  41. 8.1CVE-2021-34718EPSS 1.6%

    A vulnerability in the SSH Server process of Cisco IOS XR Software could allow an authenticated, remote attacker to overwrite and read arbitrary files on the local device. This vulnerability is due to insufficient input validation of argum…

  42. 7.8CVE-2021-21814EPSS 0.3%

    Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line. filepattern is passed directly to strlen to determine the ending location of the char* passed in by the user, n…

  43. 4.9CVE-2021-3045EPSS 0.8%

    An OS command argument injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system. This issue impacts: PAN-OS 8.1 versions earlier than PAN-…

  44. 7.2CVE-2021-3540EPSS 3.3%

    By abusing the 'install rpm info detail' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.

  45. 7.2CVE-2021-34816EPSS 2.2%

    An Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged users to execute arbitrary code on the server by installing plugins from an attacker-controlled source.

  46. 8.8CVE-2021-36122EPSS 1.0%

    An issue was discovered in Echo ShareCare 8.15.5. The UnzipFile feature in Access/EligFeedParse_Sup/UnzipFile_Upd.cfm is susceptible to a command argument injection vulnerability when processing remote input in the zippass parameter from a…

  47. 6.5CVE-2021-3256EPSS 0.9%

    KuaiFanCMS V5.x contains an arbitrary file read vulnerability in the html_url parameter of the chakanhtml.module.php file.

  48. 9.8CVE-2021-33564ExploitEPSS 72%

    An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The prob…

  49. 8.8CVE-2021-1531EPSS 30%

    A vulnerability in the web UI of Cisco Modeling Labs could allow an authenticated, remote attacker to execute arbitrary commands with the privileges of the web application on the underlying operating system of an affected Cisco Modeling La…

  50. 9.8CVE-2021-31909EPSS 3.2%

    In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible.