CVE-2023-0978

State: Published
Severity: 6.4 Medium
Published: Mar 13, 2023
Updated: Feb 27, 2025
Reserved: Feb 23, 2023

Description

A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and execute arbitrary operating system commands using specially crafted strings. This vulnerability is due to insufficient validation of arguments that are passed to specific CLI command. The vulnerability allows the attack

Scores

CVSS	Score	Vector	Source
3.1	6.4 Medium	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	trellix

Weaknesses

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

Product	Versions
Trellix Intelligent SandboxTrellix	5.0 through 5.2Affected

References

https://kcm.trellix.com/corporate/index?page=content&id=SB10397

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.