VULNERABILITY INTELLIGENCE
CVE-2019-1000018
CVSS score7.8 HIGH
EPSS probability1.88%
CISA KEVNot currently listed
Published2019-02-04
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.
Weakness classification
- nvd@nist.gov: CWE-77
Primary references
- cve@mitre.org — Mailing List, Not Applicable, Third Party Advisory
- cve@mitre.org — Exploit, Third Party Advisory
- cve@mitre.org
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Not Applicable, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory