Yelp: arbitrary file read
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 42.2-8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- yelp
fixed in 42.2-8
- yelp
Version range not reported
- yelp-xsl
Version range not reported
- yelp
Version range not reported
- yelp
Version range not reported
- yelp
Version range not reported
- yelp
Version range not reported
- yelp
Version range not reported
- yelp
Version range not reported
- yelp
Version range not reported
- yelp
Version range not reported
- yelp
Version range not reported
- yelp
Version range not reported
- yelp
Version range not reported
- yelp
Version range not reported
- yelp
Version range not reported
- yelp
Version range not reported
- yelp-xsl
Version range not reported
- yelp-xsl
Version range not reported