KEVIntel
Vulnerability detail
Enriched intelligence for a single CVE
9.8
CVSS
Critical
Critical
CVE-2023-38198
PUBLISHEDacme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023.
Exploited in the wild
Remote
Low complexity
No user interaction
- Vendor
- acmesh-official
- Product
- acme.sh
- Published
- Jul 13, 2023
- EPSS
- —
Description
acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023.
CVSS scores
CVSS v3.1
9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation status
Exploited in the wild
Recorded 2023-07-13 00:00:00 UTC · Source
SSVC decision points
- Exploitation
- none
- Automatable
- Yes
- Technical impact
- total
References
- https://github.com/acmesh-official/acme.sh/issues/4659
- https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/heXVr8o83Ys
- https://news.ycombinator.com/item?id=36252310
- https://github.com/acmesh-official/acme.sh/releases/tag/3.0.6
- https://news.ycombinator.com/item?id=36254093
- https://www.reddit.com/r/netsec/comments/144ygg7/acmesh_runs_arbitrary_commands_from_a_remote/
- http://www.openwall.com/lists/oss-security/2023/07/13/1
Known exploited vulnerability sources
Catalogues that list this CVE as a known exploited vulnerability.
| Source | Added |
|---|---|
| CVE | Jul 13, 2023 |
Timeline
-
CVE ID Reserved
-
CVE Published to Public
-
Added to KEVIntel