CVE-2013-7050

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-12-13 · updated 2026-06-17
Weakness: CWE-94

Description

The get_main_source_dir function in scripts/uscan.pl in devscripts before 2.13.8, when using USCAN_EXCLUSION, allows remote attackers to execute arbitrary commands via shell metacharacters in a directory name.

Affected products

Devscripts Devel Team Devscripts: through 2.13.7; 2.13.0, 2.13.1, 2.13.2, 2.13.3, 2.13.4, 2.13.5 (+1)

References

http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git%3Ba=commitdiff%3Bh=91f05b5
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731849
http://osvdb.org/100855
http://seclists.org/oss-sec/2013/q4/470
http://seclists.org/oss-sec/2013/q4/486
http://www.securityfocus.com/bid/64241
https://bugzilla.redhat.com/show_bug.cgi?id=1040266
https://exchange.xforce.ibmcloud.com/vulnerabilities/89666
http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git%3Ba=commitdiff%3Bh=91f05b5
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731849
http://osvdb.org/100855
http://seclists.org/oss-sec/2013/q4/470

Get alerted when CVE-2013-7050 or the next vulnerability affects your stack