CVE-2014-8630: fedoraproject fedora Command Injection
Vulnerability summary
CVE-2014-8630 is a medium (CVSS 6.5) Command Injection vulnerability in fedoraproject fedora. EPSS estimates a 2.04% chance of exploitation in the next 30 days, higher than 80.8% of scored vulnerabilities.
Timeline
- 01-02-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shell metacharacters in a product name.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
2.04%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
0.00 pp
From 2.04% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Fedoraproject1 product
- fedoraEOL20 | 21
Mageia1 product
- bugzilla< 4.4.8-1.mga4
Mozilla1 product
- bugzilla≤ 4.0.16 | 4.1 | 4.1.1 | 4.1.2 | 4.1.3 | 4.2 | 4.2:rc1 | 4.2:rc2 | 4.2.1 | 4.2.2 | 4.2.3 | 4.2.4 | 4.2.5 | 4.2.6 | 4.2.7 | 4.2.8 | 4.2.9 | 4.2.10 | 4.2.11 | 4.3 | 4.3.1 | 4.3.2 | 4.3.3 | 4.4 | 4.4:rc1 | 4.4:rc2 | 4.4.1 | 4.4.2 | 4.4.3 | 4.4.4 | 4.4.5 | 4.4.6 | 4.5 | 4.5.1 | 4.5.2 | 4.5.3 | 4.5.4 | 4.5.5 | 4.5.6
3 vendors · 3 products
References
10 links- advisories.mageia.org/MGASA-2015-0048.htmlX Refsource CONFIRM
- lists.fedoraproject.org/pipermail/package-announce/2015-February/149921.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2015-February/149925.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory