CVE-2020-15167

In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitrary code by placing a malicious `.mlrrc` file in the working directory. See linked GitHub Security Advisory for complete details. A fix is ready and will be released as Miller 5.9.1.

CVSS v3 8.2 HIGH
CVSS v2.0 4.4 MEDIUM

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.8

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

4.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 3.4 / Impact : 6.4

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/johnkerl/miller/security/advisories/GHSA-mw2v-4q78-j2cw	Exploit Third Party Advisory
https://github.com/johnkerl/miller/security/advisories/GHSA-mw2v-4q78-j2cw	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:johnkerl:miller:5.9.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-09-02 18:15

Updated : 2024-11-21 05:04

NVD link : CVE-2020-15167

Mitre link : CVE-2020-15167

CVE.ORG link : CVE-2020-15167

JSON object : View

Products Affected

johnkerl

miller

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2020-15167", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}]}, "published": "2020-09-02T18:15:11.313", "references": [{"url": "https://github.com/johnkerl/miller/security/advisories/GHSA-mw2v-4q78-j2cw", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/johnkerl/miller/security/advisories/GHSA-mw2v-4q78-j2cw", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitrary code by placing a malicious `.mlrrc` file in the working directory. See linked GitHub Security Advisory for complete details. A fix is ready and will be released as Miller 5.9.1."}, {"lang": "es", "value": "En Miller (recurso de l\u00ednea de comandos) usando el soporte de archivos de configuraci\u00f3n introducido en la versi\u00f3n 5.9.0, es posible para un atacante causar que Miller ejecute c\u00f3digo arbitrario mediante la colocaci\u00f3n de un archivo \".mlrrc\" malicioso en el directorio de trabajo. Consulte el Aviso de Seguridad de GitHub vinculado para obtener detalles completos. Una soluci\u00f3n est\u00e1 lista y ser\u00e1 publicada como Miller versi\u00f3n 5.9.1"}], "lastModified": "2024-11-21T05:04:59.373", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:johnkerl:miller:5.9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "306C8BAE-AAA5-49C0-81A1-358EDDE6CC2B"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}