CVE-2024-32487
Published: 13 April 2024
Summary
CVE-2024-32487 is a high-severity Static Code Injection (CWE-96) vulnerability in Greenwoodsoftware Less. Its CVSS base score is 8.6 (High).
Operationally, ranked in the top 43.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-30291
Vulnerability details
less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive.…
more
Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Eliminates the possibility of static code injection into saved executables by making the storage non-modifiable.