Lucene search
HistoryJun 02, 2000 - 4:00 a.m.
CVE-1999-0491
cve-1999-0491
nvd
bash
user impersonation
local user
command execution
4.6 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
7.3 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
0.4%
The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute.
Affected configurations
Node
gnubashRange≤2.04
ORgnubashMatch1.14.0
ORgnubashMatch1.14.1
ORgnubashMatch1.14.2
ORgnubashMatch1.14.3
ORgnubashMatch1.14.4
ORgnubashMatch1.14.5
ORgnubashMatch1.14.6
ORgnubashMatch1.14.7
ORgnubashMatch2.0
ORgnubashMatch2.01
ORgnubashMatch2.01.1
ORgnubashMatch2.02
ORgnubashMatch2.02.1
ORgnubashMatch2.03
ORgnubashMatch2.05
ORgnubashMatch2.05a
4.6 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
7.3 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
0.4%
Related for CVE-1999-0491