CVE-2019-17664

{"id": "CVE-2019-17664", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2019-10-16T20:15:11.183", "references": [{"url": "https://github.com/NationalSecurityAgency/ghidra/issues/107", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/NationalSecurityAgency/ghidra/issues/107", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "NSA Ghidra through 9.0.4 uses a potentially untrusted search path. When executing Ghidra from a given path, the Java process working directory is set to this path. Then, when launching the Python interpreter via the \"Ghidra Codebrowser > Window > Python\" option, Ghidra will try to execute the cmd.exe program from this working directory."}, {"lang": "es", "value": "NSA Ghidra versiones hasta 9.0.4, utiliza una ruta de b\u00fasqueda potencialmente no confiable. Al ejecutar Ghidra desde una ruta determinada, el directorio de trabajo del proceso Java se establece en esta ruta. Luego, al iniciar el int\u00e9rprete de Python por medio de la opci\u00f3n \"Ghidra Codebrowser ) Window ) Python\", Ghidra intentar\u00e1 ejecutar el programa cmd.exe desde este directorio de trabajo."}], "lastModified": "2024-11-21T04:32:43.903", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8297C6AE-DA74-4426-BB0F-6E9000B7BD4B", "versionEndIncluding": "9.0.4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}