CVE-2013-2024

HighCVSS 8.8/10Last modified Jun 16, 2026

Description

OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
chicken	chicken	before 4.9.0

References

http://www.openwall.com/lists/oss-security/2013/04/29/13Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/59320Third Party Advisory, VDB Entry
https://access.redhat.com/security/cve/cve-2013-2024Broken Link, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/85064Third Party Advisory, VDB Entry
https://lists.nongnu.org/archive/html/chicken-announce/2013-04/msg00000.htmlMailing List, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2013-2024Third Party Advisory
https://security.gentoo.org/glsa/201612-54Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/04/29/13Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/59320Third Party Advisory, VDB Entry
https://access.redhat.com/security/cve/cve-2013-2024Broken Link, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/85064Third Party Advisory, VDB Entry
https://lists.nongnu.org/archive/html/chicken-announce/2013-04/msg00000.htmlMailing List, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2013-2024Third Party Advisory
https://security.gentoo.org/glsa/201612-54Third Party Advisory

Timeline

Published: Oct 31, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-20254.3Cross-site scripting (XSS) vulnerability in Ushahidi Platform 2.5.x through 2.6.1 allows remote attackers to inject arbitrary web script or CVE-2013-20274.6Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restr CVE-2013-20287.5The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of servi CVE-2013-20296.3nagios.upgrade_to_v3.sh, as distributed by Red Hat and possibly others for Nagios Core 3.4.4, 3.5.1, and earlier, allows local users to over CVE-2013-20302.1keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing cer CVE-2013-20314.3MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CVE-2013-20325.0MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordRe CVE-2013-20332.1Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x b CVE-2013-20346.8Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.CVE-2013-20354.4Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library pat CVE-2013-20364.3Cross-site scripting (XSS) vulnerability in the Filebrowser module 6.x-2.x before 6.x-2.2 for Drupal allows remote attackers to inject arbit CVE-2013-20372.6httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the