CVE watch CVE-2014-6271 Known exploited

Shellshock: arbitrary code execution in Bash

Bash evaluated trailing code in specially crafted environment variables, giving RCE through anything that passed attacker input into the environment — CGI especially.

Severity: 9.8

critical
Vendor: GNU
Disclosed: 24 Sept 2014
Affected: GNU Bash through 4.3

CVSS breakdown

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Analysis

Placeholder analysis — replace before publishing.

References

nvd.nist.gov/vuln/detail/CVE-2014-6271