Skip to content
CVE PROGRAM SOURCE RECORD3.3 Low

CVE-2021-4326

Imperative Local Command Injection allows Activity Masking

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zowe

Description

A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Open Mainframe Project Zowe

  • 1.16.0 to < 1.28.2affected
  • 2.0.0 to < 2.5.0affected

References