CVE-2011-4195
highpriority · track · 31EPSS 0.019 · 79 %ileEUUSEPSS · scored 2026-10-27
kiwi before 4.98.05, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in an image name.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.4–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
- suse studio extension for system z= 1.2nvdUScpe:2.3:a:suse:studio_extension_for_system_z:*:*:*:*:*:*:*:*
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.htmlenisa_euvd
- http://www.openwall.com/lists/oss-security/2011/11/02/4enisa_euvd
- https://github.com/openSUSE/kiwi/commit/88bf491d16942766016c606e4210b4e072c1019fenisa_euvd
- http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.htmlVendor Advisorynvd
- http://www.openwall.com/lists/oss-security/2011/11/02/4nvd
- https://github.com/openSUSE/kiwi/commit/88bf491d16942766016c606e4210b4e072c1019fExploitPatchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan