CVE-2023-24531 Vulnerability Details

  /     /     /  

CVE-2023-24531 Metadata Quick Info

CVE Published: 02/07/2024 | CVE Updated: 21/08/2024 | CVE Year: 2023
Source: Go | Vendor: Go toolchain | Product: cmd/go
Status : PUBLISHED

---

CVE-2023-24531 Description

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn\'t sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: CWE-138: Improper Neutralization of Special Elements
Source: Go toolchain

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).