cveboard RSS feed

CVE-2023-22643

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2023
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to `os.system` calls

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in libzypp-plugin-appdata of SUSE Linux Enterprise Server for SAP 15-SP3; openSUSE Leap 15.4 allows attackers that can trick users to use specially crafted REPO_ALIAS, REPO_TYPE or REPO_METADATA_PATH settings to execute code as root. This issue affects: SUSE Linux Enterprise Server for SAP 15-SP3 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426. openSUSE Leap 15.4 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

SUSE Linux Enterprise Server for SAP 15-SP3

Vendor
SUSE
Product
SUSE Linux Enterprise Server for SAP 15-SP3
Platforms
Unknown
Default status
Unknown
SUSE Linux Enterprise Server for SAP 15-SP3 · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
libzypp-plugin-appdataaffectedcustom1.0.1+git.20180426UnavailableNone listed

openSUSE Leap 15.4

Vendor
openSUSE
Product
openSUSE Leap 15.4
Platforms
Unknown
Default status
Unknown
openSUSE Leap 15.4 · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
libzypp-plugin-appdataaffectedcustom1.0.1+git.20180426UnavailableNone listed