CVE-2023-3097 - KylinSoft kylin-software-properties setMainSource os command injection

Back Back to CVE browser

HIGH

KylinSoft kylin-software-properties setMainSource os command injection

Published Jun 5, 2023

7.8

HIGH

CVSS 3.1

EPSS 2.13%

Description

A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been rated as critical. This issue affects the function setMainSource. The manipulation leads to os command injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.1-130 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230687. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor KylinSoft Product Kylin-Software-Properties Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

KylinSoft

Kylin-Software-Properties

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (3)

https://github.com/i900008/vulndb/blob/main/kylinos_vul2.md
broken-linkexploitThird Party Advisory
https://vuldb.com/?ctiid.230687
signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.230687
vdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://github.com/i900008/vulndb/blob/main/kylinos_vul2.md		broken-linkexploitThird Party Advisory
https://vuldb.com/?ctiid.230687		signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.230687		vdb-entrytechnical-descriptionThird Party Advisory