CVE-2022-48624

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48624
close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/gwsw/less/commit/c6ac6de49698be84d264a0c4c0c40bb870b10144 Patch
https://github.com/gwsw/less/compare/v605...v606 Patch
https://greenwoodsoftware.com/less/ Release Notes
https://lists.debian.org/debian-lts-announce/2024/05/msg00018.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20240605-0010/ Third Party Advisory
https://github.com/gwsw/less/commit/c6ac6de49698be84d264a0c4c0c40bb870b10144 Patch
https://github.com/gwsw/less/compare/v605...v606 Patch
https://greenwoodsoftware.com/less/ Release Notes
https://lists.debian.org/debian-lts-announce/2024/05/msg00018.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20240605-0010/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:greenwoodsoftware:less:*:*:*:*:*:*:*:*
History

27 Mar 2025, 15:15

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CWE-78
CPE cpe:2.3:a:greenwoodsoftware:less:*:*:*:*:*:*:*:*
First Time Greenwoodsoftware less
Greenwoodsoftware
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
References () https://github.com/gwsw/less/commit/c6ac6de49698be84d264a0c4c0c40bb870b10144 - () https://github.com/gwsw/less/commit/c6ac6de49698be84d264a0c4c0c40bb870b10144 - Patch
References () https://github.com/gwsw/less/compare/v605...v606 - () https://github.com/gwsw/less/compare/v605...v606 - Patch
References () https://greenwoodsoftware.com/less/ - () https://greenwoodsoftware.com/less/ - Release Notes
References () https://lists.debian.org/debian-lts-announce/2024/05/msg00018.html - () https://lists.debian.org/debian-lts-announce/2024/05/msg00018.html - Mailing List, Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20240605-0010/ - () https://security.netapp.com/advisory/ntap-20240605-0010/ - Third Party Advisory

21 Nov 2024, 07:33

Type Values Removed Values Added
References () https://github.com/gwsw/less/commit/c6ac6de49698be84d264a0c4c0c40bb870b10144 - () https://github.com/gwsw/less/commit/c6ac6de49698be84d264a0c4c0c40bb870b10144 -
References () https://github.com/gwsw/less/compare/v605...v606 - () https://github.com/gwsw/less/compare/v605...v606 -
References () https://greenwoodsoftware.com/less/ - () https://greenwoodsoftware.com/less/ -
References () https://lists.debian.org/debian-lts-announce/2024/05/msg00018.html - () https://lists.debian.org/debian-lts-announce/2024/05/msg00018.html -
References () https://security.netapp.com/advisory/ntap-20240605-0010/ - () https://security.netapp.com/advisory/ntap-20240605-0010/ -

10 Jun 2024, 18:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/05/msg00018.html -

10 Jun 2024, 17:16

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240605-0010/ -

20 Feb 2024, 19:50

Type Values Removed Values Added
Summary
  • (es) close_altfile en filename.c en less antes de 606 omite las llamadas shell_quote para LESSCLOSE.

19 Feb 2024, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-19 01:15

Updated : 2025-03-27 15:15

NVD link : CVE-2022-48624

Mitre link : CVE-2022-48624

CVE.ORG link : CVE-2022-48624

JSON object : View

Products Affected

greenwoodsoftware

  • less
CWE
NVD-CWE-noinfo CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')