CVE-2022-45639

EUVD-2022-48503
OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the backtick command executes outside the context of the user account that entered the command line.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 74%
Affected Products (NVD)
VendorProductVersion
sleuthkitthe_sleuth_kit
4.11.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/171649/Sleuthkit-4.11.1-Command-Injection.html
http://www.binaryworld.it/
https://www.binaryworld.it/guidepoc.asp#CVE-2022-45639
http://packetstormsecurity.com/files/171649/Sleuthkit-4.11.1-Command-Injection.html
http://www.binaryworld.it/
https://www.binaryworld.it/guidepoc.asp#CVE-2022-45639