CVE-2022-45639: Command Injection

Published Jan 24, 2023

Updated

DISPUTED OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the backtick command executes outside the context of the user account that entered the command line.

Affected Software

1 affected component

sleuthkit The Sleuth Kit=4.11.1

Event History

Jan 24, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Disputed

02:15 AM

Frequently Asked Questions

What is CVE-2022-45639?

CVE-2022-45639 is an OS Command injection vulnerability in sleuthkit fls tool 4.11.1.

How does CVE-2022-45639 affect sleuthkit fls tool 4.11.1?

CVE-2022-45639 allows attackers to execute arbitrary commands via a crafted value to the m parameter.

What is the severity of CVE-2022-45639?

The severity of CVE-2022-45639 is high, with a severity value of 7.8.

Are there any known exploits or proofs of concept for CVE-2022-45639?

There are known exploits and proofs of concept for CVE-2022-45639, which can be found at the provided references.

How can I mitigate CVE-2022-45639?

To mitigate CVE-2022-45639, it is recommended to update sleuthkit to a version that does not contain the vulnerability.