Argument injection vulnerability in the SSH URI handler for Safari on Mac OS 10.3.3 and earlier allows remote attackers to (1) execute arbitrary code via the ProxyCommand option or (2) conduct port forwarding via the -R option.
Threat-Mapped Scoring
Score: 1.8
Priority: P4 - Informational (Low)
S9 – Sabotage of System/App
EPSS
Score: 0.14294 Percentile:
0.94078
CVSS Scoring
CVSS v2 Score: 7.6
Severity:
Mapped CWE(s)
CWE-88
: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
All CAPEC(s)
CAPEC-137: Parameter Injection
CAPEC-174: Flash Parameter Injection
CAPEC-41: Using Meta-characters in E-mail Headers to Inject Malicious Payloads