CVE Feed

    Dashboard / CVE / CVE-2023-38198

    CVE-2023-38198

    acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023.

    Published:Jul 13, 2023
    Last Modified:Feb 13, 2025
    EPS:Jul 13, 2023
    EPSS Score:0.00196
    CVSS Score:9.8

    Affected Products

    Vendor
    Acme.sh Project
    Product
    Acme.sh

    Exploits

    No exploit reference

    References

    http://www.openwall.com/lists/oss-security/2023/07/13/1
    https://github.com/acmesh-official/acme.sh/issues/4659
    https://github.com/acmesh-official/acme.sh/releases/tag/3.0.6
    https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/heXVr8o83Ys
    https://news.ycombinator.com/item?id=36252310
    https://news.ycombinator.com/item?id=36254093
    https://www.reddit.com/r/netsec/comments/144ygg7/acmesh_runs_arbitrary_commands_from_a_remote/
    http://www.openwall.com/lists/oss-security/2023/07/13/1
    https://github.com/acmesh-official/acme.sh/issues/4659
    https://github.com/acmesh-official/acme.sh/releases/tag/3.0.6
    https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/heXVr8o83Ys
    https://news.ycombinator.com/item?id=36252310
    https://news.ycombinator.com/item?id=36254093
    https://www.reddit.com/r/netsec/comments/144ygg7/acmesh_runs_arbitrary_commands_from_a_remote/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High