CVE-2008-4690 Command injection in n/a

Critical 10.0 Published 22 Oct 2008 Updated 7 Aug 2024

Remote attackers can execute arbitrary commands via crafted lynxcgi URLs if advanced mode and URL handler are enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2008-4690?

CVE-2008-4690 is a critical command injection vulnerability in n/a, published on 22 Oct 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

lynx 2.8.6dev.15 and earlier, when advanced mode is enabled and lynx is configured as a URL handler, allows remote attackers to execute arbitrary commands via a crafted lynxcgi: URL, a related issue to CVE-2005-2929. NOTE: this might only be a vulnerability in limited deployments that have defined a lynxcgi: handler.

Which versions are affected by CVE-2008-4690?

It affects 1 product.

Products include Lynx Lynx.

How do I fix CVE-2008-4690?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2008-4690 being exploited?

There is no known exploitation of CVE-2008-4690 in the wild and no public exploit code.

Sources

Also known as GHSA-wjrg-f7gg-3p35.