CVE-2022-31249
A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allows remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.76%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allows remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.76% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- suse/wrangler
- Source
- meissner@suse.de
References
- https://bugzilla.suse.com/show_bug.cgi?id=1200299Issue Tracking
- https://bugzilla.suse.com/show_bug.cgi?id=1200299Issue Tracking
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.