CVE-2013-1436

2014-10-0623:55:05

CWE-94

[email protected]

web.nvd.nist.gov

xmonad

dynamiclog

xmonad-contrib

cve-2013-1436

security vulnerability

arbitrary commands

remote code execution

web page title

xmobar window title

action tag

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.3 High

AI Score

Confidence

Low

0.067 Low

EPSS

Percentile

93.9%

JSON

The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.

Affected configurations

NVD

Node

xmonadxmonad-contrabRange≤0.11.1

xmonadxmonad-contrabMatch0.11

CPENameOperatorVersion
xmonad:xmonad-contrabxmonad xmonad-contrable0.11.1
xmonad:xmonad-contrabxmonad xmonad-contrabeq0.11

CPE	Name	Operator	Version
xmonad:xmonad-contrab	xmonad xmonad-contrab	le	0.11.1
xmonad:xmonad-contrab	xmonad xmonad-contrab	eq	0.11

References

handra.rampa.sk/dawb/patch?repoPURL=http%3A%2F%2Fcode.haskell.org%2FXMonadContrib&repoPHash=20130708144813-1499c-0c3e284d3523c0694b9423714081761813bc1e89

security.gentoo.org/glsa/glsa-201405-28.xml

www.openwall.com/lists/oss-security/2013/07/26/5

www.securityfocus.com/bid/61491