Back to Database
Status published
High
CVE-2019-1000018
rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special...
Vulnerability Description
rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-1000018
Credits & Attribution
No credits recorded in the NVD database.
References
- https://esnet-security.github.io/vulnerabilities/20190115_rssh
- https://www.debian.org/security/2019/dsa-4377
- https://lists.debian.org/debian-lts-announce/2019/01/msg00027.html
- https://usn.ubuntu.com/3946-1/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN/
- https://security.gentoo.org/glsa/202007-29
- http://seclists.org/fulldisclosure/2021/May/78
- https://github.com/WlX-33/PoC-for-CVE/blob/main/CVE-2021-33216%2CCVE-2019-1000018/CommScope%20Ruckus%20IoT%20Controller%201.7.1.0%20Undocumented%20Account.txt
More from pizzashack
View All →CVE-2012-3478
rssh 2.3.3 and earlier allows local users to bypass intended...
Low
2.1
CVE-2012-2252
Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync...
Medium
4.4
CVE-2012-2251
rssh 2.3.2, as used by Debian, Fedora, and others, when...
Medium
4.4
CVE-2004-1628
Format string vulnerability in log.c in rssh before 2.2.2 allows...
Critical
9
Affected Vendor
pizzashack
View all reports →Affected Software
rssh, debian linux, fedora, ubuntu linux
Vulnerable Versions:
2.3.4, 8.0, 9.0, 29, 30, 31, 14.04, 16.04, 18.04, 18.10
Timeline
Official Publish:
February 4th, 2019
Last Modified:
March 19th, 2025
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.