VULNERABILITY INTELLIGENCE
CVE-2011-1154
CVSS score6.9 MEDIUM
EPSS probability0.41%
CISA KEVNot currently listed
Published2011-03-30
Last modified2026-06-16
CVSS vectorAV:L/AC:M/Au:N/C:C/I:C/A:C
Description
The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.
Weakness classification
- CWE-20: Improper Input Validation