« Volver al listado

CVE-2013-1057

Estado: ModificadaMedia (4.4)—

Untrusted search path vulnerability in maas-import-pxe-files in MAAS before 13.10 allows local users to execute arbitrary code via a Trojan horse import_pxe_files configuration file in the current working directory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Canonical — MaasCanonical — Ubuntu Linux

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-1057",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.4,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "security@ubuntu.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-11-18T02:55:05.750",
  "references": [
    {
      "url": "http://secunia.com/advisories/55567",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://ubuntu.com/usn/usn-2013-1",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://bugs.launchpad.net/maas/+bug/1158425",
      "tags": [
        "Exploit"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://launchpad.net/maas/+milestone/13.10",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/55567",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://ubuntu.com/usn/usn-2013-1",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.launchpad.net/maas/+bug/1158425",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://launchpad.net/maas/+milestone/13.10",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Untrusted search path vulnerability in maas-import-pxe-files in MAAS before 13.10 allows local users to execute arbitrary code via a Trojan horse import_pxe_files configuration file in the current working directory."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ruta de búsqueda no confiable en maas-import-pxe-files en MAAS anteriores a 13.10 permite a usuarios locales ejecutar código arbitrario a través de un fichero de configuración import_pxe_files \"troyanizado\" en el directorio de trabajo actual."
    }
  ],
  "lastModified": "2026-06-16T23:50:47.137",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5D324C4-97C7-49D3-A809-9EAD4B690C69"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2076871-2E80-4605-A470-A41C1A8EC7EE"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFAA48D9-BEB4-4E49-AD50-325C262D46D9"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:canonical:maas:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39DC5796-9A1F-4E3A-A308-E671CD5576A1",
              "versionEndIncluding": "12.04.4"
            },
            {
              "criteria": "cpe:2.3:a:canonical:maas:12.04.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "305EA6BB-C24C-44A1-AA40-60362AD31802"
            },
            {
              "criteria": "cpe:2.3:a:canonical:maas:12.04.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CBEF1FF-9714-499F-B50F-4945825EBD15"
            },
            {
              "criteria": "cpe:2.3:a:canonical:maas:12.04.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "240C821D-C3D7-4CC4-B716-CCDC7513745C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@ubuntu.com"
}