VULNERABILITY INTELLIGENCE

CVE-2018-12562

CVSS score9.8 CRITICAL
EPSS probability1.66%
CISA KEVNot currently listed
Published2018-06-19
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).

Weakness classification

  • CWE-20: Improper Input Validation

Primary references