sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument.
sensible-browser en sensible-utils en versiones anteriores a la 0.0.11 no valida cadenas antes de iniciar el programa especificado por la variable de entorno BROWSER. Esto permite que atacantes remotos lleven a cabo ataques de inyección de argumentos mediante una URL manipulada, tal y como demuestra un argumento --proxy-pac-file.
AV:N/AC:M/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-74
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| sensible-utils_project | sensible-utils | * | <built-in method update of dict object at 0x7fd36b155680> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:sensible-utils_project:sensible-utils:*:*:*:*:*:*:*:* |