CVEvulnerability

CVE-2013-1362

7.5 HIGH Published 2013-07-09 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-07-09
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-20

Description

Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters, which are processed by bash.

Affected configurations

• opensuse opensuse 11.4 • opensuse opensuse 12.1 • opensuse opensuse 12.2 • nagios remote plug in executor (<= 2.13) • nagios remote plug in executor 1.3 • nagios remote plug in executor 1.4 • nagios remote plug in executor 1.5 • nagios remote plug in executor 1.6 • nagios remote plug in executor 1.7 • nagios remote plug in executor 1.8 • nagios remote plug in executor 1.9 • nagios remote plug in executor 2.0 • nagios remote plug in executor 2.0b1 • nagios remote plug in executor 2.0b2 • nagios remote plug in executor 2.0b3 • nagios remote plug in executor 2.0b4 • nagios remote plug in executor 2.0b5 • nagios remote plug in executor 2.3 • nagios remote plug in executor 2.4 • nagios remote plug in executor 2.5 • nagios remote plug in executor 2.5.1 • nagios remote plug in executor 2.5.2 • nagios remote plug in executor 2.6 • nagios remote plug in executor 2.7 • nagios remote plug in executor 2.7.1 • nagios remote plug in executor 2.8 • nagios remote plug in executor 2.8.1 • nagios remote plug in executor 2.8b1 • nagios remote plug in executor 2.9 • nagios remote plug in executor 2.10 • nagios remote plug in executor 2.11 • nagios remote plug in executor 2.12

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References