CVE-2023-1277

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222600.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
n/a	kylin-system-updater	1.4.20kord

References

https://github.com/cn-lwj/vuldb/blob/master/kylin-system-updater_vuln.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.222600Permissions Required, Third Party Advisory
https://vuldb.com/?id.222600Third Party Advisory
https://github.com/cn-lwj/vuldb/blob/master/kylin-system-updater_vuln.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.222600Permissions Required, Third Party Advisory
https://vuldb.com/?id.222600Third Party Advisory

Timeline

Published: Mar 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-12786.1A vulnerability, which was classified as problematic, has been found in IBOS up to 4.5.5. Affected by this issue is some unknown functionali CVE-2023-12796.1An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5 CVE-2023-12817.8Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can CVE-2023-12826.1The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload P CVE-2023-12839.8Code Injection in GitHub repository builderio/qwik prior to 0.21.0.CVE-2023-12855.9Signal Handler Race Condition vulnerability in Mitsubishi Electric India GC-ENET-COM whose first 2 digits of 11-digit serial number of unit CVE-2023-12864.8Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.CVE-2023-12879.8An XSL template vulnerability in ENOVIA Live Collaboration V6R2013xE allows Remote Code Execution.CVE-2023-12887.5An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the se CVE-2023-12895.5A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw all CVE-2023-12909.8A vulnerability, which was classified as critical, has been found in SourceCodester Sales Tracker Management System 1.0. Affected by this is CVE-2023-12919.8A vulnerability, which was classified as critical, was found in SourceCodester Sales Tracker Management System 1.0. This affects an unknown