FKIE_CVE-2013-7050

Vulnerability from fkie_nvd - Published: 2013-12-13 18:07 - Updated: 2026-06-17 00:01
Severity
Summary
The get_main_source_dir function in scripts/uscan.pl in devscripts before 2.13.8, when using USCAN_EXCLUSION, allows remote attackers to execute arbitrary commands via shell metacharacters in a directory name.
References
cve@mitre.orghttp://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git%3Ba=commitdiff%3Bh=91f05b5
cve@mitre.orghttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731849
cve@mitre.orghttp://osvdb.org/100855
cve@mitre.orghttp://seclists.org/oss-sec/2013/q4/470Patch
cve@mitre.orghttp://seclists.org/oss-sec/2013/q4/486
cve@mitre.orghttp://www.securityfocus.com/bid/64241
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=1040266Patch
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/89666
af854a3a-2127-422b-91ae-364da2661108http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git%3Ba=commitdiff%3Bh=91f05b5
af854a3a-2127-422b-91ae-364da2661108http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731849
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/100855
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/oss-sec/2013/q4/470Patch
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/oss-sec/2013/q4/486
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/64241
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1040266Patch
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/89666
Impacted products
Vendor Product Version
devscripts_devel_team devscripts *
devscripts_devel_team devscripts 2.13.0
devscripts_devel_team devscripts 2.13.1
devscripts_devel_team devscripts 2.13.2
devscripts_devel_team devscripts 2.13.3
devscripts_devel_team devscripts 2.13.4
devscripts_devel_team devscripts 2.13.5
devscripts_devel_team devscripts 2.13.6
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:devscripts_devel_team:devscripts:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C55DCA95-69BB-4155-B0BA-012CB0453A15",
              "versionEndIncluding": "2.13.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devscripts_devel_team:devscripts:2.13.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E1C3E21-A06A-4922-834A-0D28F8722B4F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devscripts_devel_team:devscripts:2.13.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6608A1F3-5266-45EC-9BAD-ECCF67C3BDC4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devscripts_devel_team:devscripts:2.13.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "32157B0A-85E8-4A21-86EA-1144309C2AD4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devscripts_devel_team:devscripts:2.13.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "674AC75A-4934-45FD-8198-0522CA36C136",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devscripts_devel_team:devscripts:2.13.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "0434ED70-5BD5-4862-ACB9-48235D5A8D4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devscripts_devel_team:devscripts:2.13.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "655BFC26-CF34-4D23-91A1-7EC0F6EA7403",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:devscripts_devel_team:devscripts:2.13.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A21D910-5467-4B69-ACD8-4CCC48806945",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The get_main_source_dir function in scripts/uscan.pl in devscripts before 2.13.8, when using USCAN_EXCLUSION, allows remote attackers to execute arbitrary commands via shell metacharacters in a directory name."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n get_main_source_dir en scripts/uscan.pl en devscripts anterior a 2.13.8, al utilizar USCAN_EXCLUSION, permite a atacantes remotos ejecutar comandos arbitrarios mediante metacaracteres de shell en un nombre de directorio."
    }
  ],
  "id": "CVE-2013-7050",
  "lastModified": "2026-06-17T00:01:20.300",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2013-12-13T18:07:54.703",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git%3Ba=commitdiff%3Bh=91f05b5"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731849"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/100855"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://seclists.org/oss-sec/2013/q4/470"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://seclists.org/oss-sec/2013/q4/486"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/64241"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1040266"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89666"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git%3Ba=commitdiff%3Bh=91f05b5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731849"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/100855"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://seclists.org/oss-sec/2013/q4/470"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/oss-sec/2013/q4/486"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/64241"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1040266"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89666"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.