Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2018-1000500

Date: June 26, 2018

Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file";.

Language: C

Severity Score

Related Resources (8)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000500
http://lists.busybox.net/pipermail/busybox/2018-May/086462.html
https://security.alpinelinux.org/vuln/CVE-2018-1000500
https://security-tracker.debian.org/tracker/CVE-2018-1000500
https://git.busybox.net/busybox/commit/?id=45fa3f18adf57ef9d743038743d9c90573aeeb91
https://people.canonical.com/~ubuntu-security/cve/CVE-2018-1000500
https://usn.ubuntu.com/4531-1/
https://www.mend.io/vulnerability-database/CVE-2018-1000500

Severity Score

Weakness Type (CWE)

Improper Certificate Validation

CWE-295

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us