QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2019-14889

Back to search

CVE-2019-14889

Published: Dec 10, 2019

Modified: Aug 5, 2024

PUBLISHED

CVSS v3.0

7.1

HIGH

Description

A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.

VendorProductVersions

Red Hat

libssh

affected
All libssh versions before 0.9.3
affected
All libssh versions before 0.8.8

Weaknesses (CWE)

CWE-78

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

USN-4219-1
vendor-advisory
openSUSE-SU-2019:2689
vendor-advisory
FEDORA-2019-8b0ad69829
vendor-advisory
FEDORA-2019-46b6bd2459
vendor-advisory
openSUSE-SU-2020:0102
vendor-advisory
GLSA-202003-27
vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now