CVE-2024-32487

Description

less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.

CVSS v3.1 Score

8.6

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness Type (CWE)

CWE-96 CWE-96

Affected Products

Vendor	Product	Versions
greenwoodsoftware	less	< 653
debian	debian_linux	All
netapp	bootstrap_os	All
netapp	hci_compute_node	All
netapp	hci_storage_nodes	All
netapp	solidfire	All

References

Advisories & Patches

https://github.com/gwsw/less/commit/007521ac3c95bc76e3d59c6dbfe75d06c8075c33 https://security.netapp.com/advisory/ntap-20240605-0009/ https://www.openwall.com/lists/oss-security/2024/04/13/2 https://github.com/gwsw/less/commit/007521ac3c95bc76e3d59c6dbfe75d06c8075c33 https://security.netapp.com/advisory/ntap-20240605-0009/ https://www.openwall.com/lists/oss-security/2024/04/13/2

Other References

http://www.openwall.com/lists/oss-security/2024/04/15/1 https://lists.debian.org/debian-lts-announce/2024/05/msg00018.html https://www.openwall.com/lists/oss-security/2024/04/12/5 http://www.openwall.com/lists/oss-security/2024/04/15/1 https://lists.debian.org/debian-lts-announce/2024/05/msg00018.html https://www.openwall.com/lists/oss-security/2024/04/12/5

Frequently Asked Questions

What is CVE-2024-32487? +

less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases. It has a CVSS v3.1 base score of 8.6 (HIGH).

How severe is CVE-2024-32487? +

CVE-2024-32487 has a CVSS v3.1 score of 8.6 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-32487? +

CVE-2024-32487 affects products from debian, greenwoodsoftware, netapp, specifically: bootstrap_os, debian_linux, hci_compute_node, hci_storage_nodes, less, solidfire. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-32487? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-30091

In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers …

CVE-2015-2079 9.9

Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three …

CVE-2024-55662 9.9

XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances …

CVE-2024-55877 9.9

XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any …

CVE-2024-13264 9.8

Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File …

CVE-2024-43400 9.0

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible …