CVE-2017-8799 - CVE House
Back to Database
Status published Critical CVE-2017-8799

Untrusted input execution via igetwild in all iRODS versions before...

Vulnerability Description

Untrusted input execution via igetwild in all iRODS versions before 4.1.11 and 4.2.1 allows other iRODS users (potentially anonymous) to execute remote shell commands via iRODS virtual pathnames. To exploit this vulnerability, a virtual iRODS pathname that includes a semicolon would be retrieved via igetwild. Because igetwild is a Bash script, the part of the pathname following the semicolon would be executed in the user's shell.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-8799

Credits & Attribution

No credits recorded in the NVD database.

References

More from irods

View All →
CVE-2012-5895
Multiple unspecified vulnerabilities in iRODS before 3.1 have unknown impact...
Critical 10

Affected Vendor

Affected Software

irods
Vulnerable Versions:
0, 4.2.0

Timeline

Official Publish: May 5th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.