RCE in Adaptivecomputing Torque Resource Manager
CVE-2013-4495
The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.033 (87.1th percentile) — read the EPSS interpretation.
Affected products
- Adaptivecomputing Torque_resource_manager — versions 2.0.0, 2.1.2, 2.1.3
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)