« Volver al listado

CVE-2008-3907

Estado: ModificadaMedia (6.8)—

El comando open-in-browser en newsbeuter versiones anteriores a 1.1 permite a atacantes remotos ejecutar comandos de su elección a través de metacaracteres de consola en una URL fuente.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Newsbeuter — Newsbeuter

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-3907",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-09-04T17:41:00.000",
  "references": [
    {
      "url": "http://newsbeuter.wordpress.com/2008/09/01/newsbeuter-11-released-contains-security-fix-please-upgrade/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/31676",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/31995",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200809-12.xml",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.newsbeuter.org/downloads/CHANGES",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2008/09/01/4",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/30964",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44791",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://newsbeuter.wordpress.com/2008/09/01/newsbeuter-11-released-contains-security-fix-please-upgrade/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/31676",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/31995",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200809-12.xml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.newsbeuter.org/downloads/CHANGES",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2008/09/01/4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/30964",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44791",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The open-in-browser command in newsbeuter before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a feed URL."
    },
    {
      "lang": "es",
      "value": "El comando open-in-browser en newsbeuter versiones anteriores a 1.1 permite a atacantes remotos ejecutar comandos de su elección a través de metacaracteres de consola en una URL fuente."
    }
  ],
  "lastModified": "2026-06-16T22:56:47.063",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:newsbeuter:newsbeuter:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "276F919F-3181-4ADE-A181-7A8776115338",
              "versionEndIncluding": "1.0"
            },
            {
              "criteria": "cpe:2.3:a:newsbeuter:newsbeuter:0.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1E21217-98D9-4FAD-88D4-652746FB05C1"
            },
            {
              "criteria": "cpe:2.3:a:newsbeuter:newsbeuter:0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA51EDB2-94CD-421C-B7D9-5E3FEEAD194E"
            },
            {
              "criteria": "cpe:2.3:a:newsbeuter:newsbeuter:0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4AF4978C-4EBF-41ED-962F-0890E5BDC071"
            },
            {
              "criteria": "cpe:2.3:a:newsbeuter:newsbeuter:0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DCDA3939-74B1-4A44-955D-1BA1D2A23C0F"
            },
            {
              "criteria": "cpe:2.3:a:newsbeuter:newsbeuter:0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B242B9F1-3B5B-41EE-8CFF-BCC3008B785A"
            },
            {
              "criteria": "cpe:2.3:a:newsbeuter:newsbeuter:0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "733B891C-63E6-45A2-AE6D-32A4C860A07D"
            },
            {
              "criteria": "cpe:2.3:a:newsbeuter:newsbeuter:0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "684B7199-9344-4DBA-90AD-DEDEC056F213"
            },
            {
              "criteria": "cpe:2.3:a:newsbeuter:newsbeuter:0.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45CD698E-70A1-43A0-B828-3DBD519DDDF9"
            },
            {
              "criteria": "cpe:2.3:a:newsbeuter:newsbeuter:0.8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "379E21B5-D427-45EC-B674-9BCC8A47CA76"
            },
            {
              "criteria": "cpe:2.3:a:newsbeuter:newsbeuter:0.8.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB0B1B93-8E8C-4A77-98F8-CE5BFED550DF"
            },
            {
              "criteria": "cpe:2.3:a:newsbeuter:newsbeuter:0.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C907407-E178-43BF-A433-9BC73EB7FD5F"
            },
            {
              "criteria": "cpe:2.3:a:newsbeuter:newsbeuter:0.9.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB3A20C1-1FB7-43C8-A78E-FBEBB4E888AF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "http://www.openwall.com/lists/oss-security/2008/09/01/4\r\n\r\n\"The previous version allowed to execute arbitrary code by a \r\ncrafted feed URL that is passed as a command line parameter \r\nif the URL is opened by an external browser.\"",
  "sourceIdentifier": "cve@mitre.org"
}