CVE-2023-3097
MediumCVSS 5.3Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
A critical vulnerability was found in KylinSoft kylin-software-properties on KylinOS, affecting the setMainSource function. Manipulation of this function leads to OS command injection.
Risk Assessment
The vulnerability requires local access to the system, increasing the risk of attack if a malicious user gains access. The public disclosure of the exploit may lead to its use by unauthorized individuals.
Recommendation
It is recommended to upgrade to version 0.0.1-130 to address this vulnerability. Additionally, monitor system access to detect potential attack attempts.
Original NVD description (English source)
A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been rated as critical. This issue affects the function setMainSource. The manipulation leads to os command injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.1-130 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230687. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.