Ubuntu.comUB:CVE-2019-12928CVE-2019-12928
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.005 Low
EPSS
Percentile
76.8%
DISPUTED The QMP migrate command in QEMU version 4.0.0 and earlier is
vulnerable to OS command injection, which allows the remote attacker to
achieve code execution, denial of service, or information disclosure by
sending a crafted QMP command to the listening server. Note: This has been
disputed as a non-issue since QEMU’s -qmp interface is meant to be used by
trusted users. If one is able to access this interface via a tcp socket
open to the internet, then it is an insecure configuration issue.
Notes
| Author | Note |
|---|---|
| mdeslaur | marking as ignored as this is working as designed and should not be used by non-trusted users |
Related
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.005 Low
EPSS
Percentile
76.8%