CVE-2013-4495

TORQUE Resource Manager < 4.2.6 - Remote Code Execution via Email Parameter to qsub

Title source: llm
STIX 2.1

Description

The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.

References (4)

Core 4
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/55622
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2013/dsa-2796
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/55535

Scores

EPSS 0.0327
EPSS Percentile 86.9%

Details

CWE
CWE-94
Status published
Products (50)
adaptivecomputing/torque_resource_manager 2.0.0
adaptivecomputing/torque_resource_manager 2.1.2
adaptivecomputing/torque_resource_manager 2.1.3
adaptivecomputing/torque_resource_manager 2.1.6
adaptivecomputing/torque_resource_manager 2.1.7
adaptivecomputing/torque_resource_manager 2.1.8
adaptivecomputing/torque_resource_manager 2.1.9
adaptivecomputing/torque_resource_manager 2.1.10
adaptivecomputing/torque_resource_manager 2.1.11
adaptivecomputing/torque_resource_manager 2.2.0
... and 40 more
Published Nov 20, 2013
Tracked Since Feb 18, 2026