Vulnerability Intelligence Report
CVE-2012-5534
The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin, related to "shell expansion."
No Active Exploit Signals
CVSS Base Score
7.5
HIGH
EPSS Probability:4.44%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| flashtux | weechat | 0.3.0, 0.3.1, 0.3.1.1, 0.3.2, 0.3.3, 0.3.4, 0.3.6, 0.3.7, 0.3.8, 0.3.9, 0.3.9.1 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
4.442%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Red Hat, Inc. · Vendor · USA |
| Reserved | 2012-10-24T00:00:00 |
| Published | 2012-12-03T21:00:00 |
| Patch Date | 2012-11-18 |
| Last Updated | 2024-08-06T21:05:47 |
Community Chatter & Buzz