CVE-2007-2348 - CVE House
Back to Database
Status published Medium CVE-2007-2348

mirror --script in lftp before 3.5.9 does not properly quote...

Vulnerability Description

mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script. NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands such as "get" which could overwrite executable files.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-2348

Credits & Attribution

No credits recorded in the NVD database.

References

More from alexander v. lukyanov

View All →
CVE-2010-2251
The get1 command, as used by lftpget, in LFTP before...
High 7.5
CVE-2003-0963
Buffer overflows in (1) try_netscape_proxy and (2) try_squid_eplf for lftp...
High 7.5

Affected Vendor

alexander v. lukyanov

View all reports →

Affected Software

lftp
Vulnerable Versions:
0

Timeline

Official Publish: April 27th, 2007
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.