CVE-2019-1000018

EUVD-2019-1737
rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 51%
Affected Products (NVD)
VendorProductVersion
pizzashackrssh
2.3.4
debiandebian_linux
8.0
debiandebian_linux
9.0
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
18.10
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
rssh
bionic
Fixed 2.3.4-7ubuntu0.1
released
cosmic
Fixed 2.3.4-8ubuntu0.2
released
trusty
Fixed 2.3.4-4+deb8u2build0.14.04.2
released
xenial
Fixed 2.3.4-4+deb8u2build0.16.04.2
released
Common Weakness Enumeration
References
http://seclists.org/fulldisclosure/2021/May/78
https://esnet-security.github.io/vulnerabilities/20190115_rssh
https://github.com/WlX-33/PoC-for-CVE/blob/main/CVE-2021-33216%2CCVE-2019-1000018/CommScope%20Ruckus%20IoT%20Controller%201.7.1.0%20Undocumented%20Account.txt
https://lists.debian.org/debian-lts-announce/2019/01/msg00027.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557/
https://security.gentoo.org/glsa/202007-29
https://usn.ubuntu.com/3946-1/
https://www.debian.org/security/2019/dsa-4377
http://seclists.org/fulldisclosure/2021/May/78
https://esnet-security.github.io/vulnerabilities/20190115_rssh
https://lists.debian.org/debian-lts-announce/2019/01/msg00027.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557/
https://security.gentoo.org/glsa/202007-29
https://usn.ubuntu.com/3946-1/
https://www.debian.org/security/2019/dsa-4377