CVE-2003-0152 Command injection in n/a

High 7.5 Published 26 Mar 2003 Updated 8 Aug 2024

Remote attackers can execute arbitrary commands on the server via the Bonsai CVS query tool, requiring immediate patching.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2003-0152?

CVE-2003-0152 is a high-severity command injection vulnerability in n/a, published on 26 Mar 2003. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Unknown vulnerability in bonsai Mozilla CVS query tool allows remote attackers to execute arbitrary commands as the www-data user.

Which versions are affected by CVE-2003-0152?

It affects 1 product.

Products include Mozilla Bonsai.

How do I fix CVE-2003-0152?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2003-0152 being exploited?

There is no known exploitation of CVE-2003-0152 in the wild and no public exploit code.

Sources

Also known as GHSA-cxmw-24hm-2x99.