# Shellshock (CVE-2014-6271) Shellshock, the Bash code execution bug, with CVSS v3.1 9.8, CWE-78 and more than 300 references. Source: https://docs.deepinfo.com/reference/vulnerability/detail/examples/cve-2014-6271/ Last updated: 2026-09-24 --- `GET https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2014-6271` Shellshock, the Bash code execution bug, with CVSS v3.1 9.8, CWE-78 and more than 300 references. Example 2 of 7 in **Well-Known CVEs** · [Vulnerability Detail Examples](/reference/vulnerability/detail/examples/) · endpoint: [Detail](/reference/vulnerability/detail/) Tags: `param` `cve` · `value` `CVE-2014-6271` Asks for `CVE-2014-6271`, the GNU Bash bug that ran code from environment variables. ## What to Notice - `metrics.cvss_metric_v2` scores it 10.0 and `metrics.cvss_metric_v31` 9.8 (`CRITICAL`). - `enrichment.cwe` maps it to CWE-78, OS command injection. - `references` shows 10 of the 341 references the record carries; `configurations` 10 of 26. ## Request | Parameter | In | Value | |---|---|---| | `cve` | query | `CVE-2014-6271` | ```bash curl 'https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2014-6271' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' ``` ## Response ### 200 · OK > Shortened for this page: references: 10 of 341 shown; configurations: 10 of 26 shown; configurations[].nodes[].cpe_match: first 10 items; enrichment.cpe: first 10 items; enrichment.cpe[].affected_versions: first 10 items; enrichment.cpe[].cpe_names: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "id": "CVE-2014-6271", "source_identifier": "user@debian.org", "published": "2014-09-24T18:48:04Z", "last_modified": "2026-06-17T00:12:48Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": "2022-01-28", "cisa_action_due": "2022-07-28", "cisa_required_action": "Apply updates per vendor instructions.", "cisa_vulnerability_name": "GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability", "descriptions": [ { "lang": "en", "value": "GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka \"ShellShock.\" NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix." }, { "lang": "es", "value": "GNU Bash hasta la versión 4.3 procesa cadenas finales después de las definiciones de funciones en los valores de variables de entorno, lo que permite a atacantes remotos ejecutar código arbitrario a través de un entorno manipulado, tal como se ha demostrado por vectores que involucran la característica ForceCommand en sshd OpenSSH, los módulos mod_cgi y mod_cgid en el Apache HTTP Server, scripts ejecutados por clientes DHCP no especificados, y otras situaciones en las cuales el ajuste de entorno ocurre a través de un límite privilegiado de la ejecución de Bash, también conocido como \"ShellShock.\" NOTA: la reparación original para este problema era incorrecta; CVE-2014-7169 ha sido asignada para cubrir la vulnerabilidad que todavía está presente después de la solución incorrecta." } ], "references": [ { "url": "http://advisories.mageia.org/MGASA-2014-0388.html", "source": "user@debian.org", "tags": [ "Third Party Advisory" ] }, { "url": "http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html", "source": "user@debian.org", "tags": [ "Broken Link", "Third Party Advisory" ] }, { "url": "http://jvn.jp/en/jp/JVN55667175/index.html", "source": "user@debian.org", "tags": [ "Vendor Advisory" ] }, { "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126", "source": "user@debian.org", "tags": [ "Third Party Advisory", "VDB Entry", "Vendor Advisory" ] }, { "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673", "source": "user@debian.org", "tags": [ "Third Party Advisory" ] }, { "url": "http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html", "source": "user@debian.org", "tags": [ "Exploit", "Issue Tracking", "Third Party Advisory" ] }, { "url": "http://linux.oracle.com/errata/ELSA-2014-1293.html", "source": "user@debian.org", "tags": [ "Third Party Advisory" ] }, { "url": "http://linux.oracle.com/errata/ELSA-2014-1294.html", "source": "user@debian.org", "tags": [ "Third Party Advisory" ] }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00028.html", "source": "user@debian.org", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00029.html", "source": "user@debian.org", "tags": [ "Mailing List", "Third Party Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 }, { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "COMPLETE", "integrity_impact": "COMPLETE", "availability_impact": "COMPLETE", "base_score": 10.0, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 10.0, "impact_score": 10.0, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-78" } ] }, { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-78" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:gnu:bash:*:*:*:*:*:*:*:*", "match_criteria_id": "F4DBE402-1B0A-4854-ABE5-891321454C25", "version_start_including": null, "version_start_excluding": null, "version_end_including": "4.3", "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "match_criteria_id": "DCA5A28D-79B6-4F3E-9C98-65D4DFAD8EE7", "version_start_including": "4.9.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.9.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "match_criteria_id": "9B1DC7EF-C994-4252-9DFE-DCA63FB17AE0", "version_start_including": "4.10.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.10.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "match_criteria_id": "9056776F-03F6-4C3D-8635-37D66FD16EAA", "version_start_including": "4.11.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.11.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "match_criteria_id": "AFEE6963-F73F-4B71-B4F8-6E550FBDA5F6", "version_start_including": "4.12.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.12.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "match_criteria_id": "8296875A-64FA-4592-848A-A923126BD8AF", "version_start_including": "4.13.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.13.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "match_criteria_id": "816A16AF-1F5E-483A-AA89-3022818FAE43", "version_start_including": "4.14.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.14.4f" } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:oracle:linux:4:*:*:*:*:*:*:*", "match_criteria_id": "F8421899-5D10-4C2B-88AA-3DA909FE3E67", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*", "match_criteria_id": "62A2AC02-A933-4E51-810E-5D040B476B7B", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*", "match_criteria_id": "D7B037A8-72A6-4DFF-94B2-D688A5F6F876", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "match_criteria_id": "BE8B7F1F-22F6-4B10-A6E5-DE44B1D2E649", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.1.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:4.1.1:-:*:*:*:*:*:*", "match_criteria_id": "F407EA72-BA1A-41A2-B699-874304A638A5", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:qnap:qts:4.1.1:build_0927:*:*:*:*:*:*", "match_criteria_id": "DDA25903-B334-438B-8196-B9E5119199D1", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:mageia:mageia:3.0:*:*:*:*:*:*:*", "match_criteria_id": "76F1E356-E019-47E8-AA5F-702DA93CF74E", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:mageia:mageia:4.0:*:*:*:*:*:*:*", "match_criteria_id": "F805A106-9A6F-48E7-8582-D3C5A26DFC11", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.1:*:*:*:*:*:*:*", "match_criteria_id": "EC489F35-07F1-4C3E-80B9-78F0689BC54B", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:redhat:virtualization:3.4:*:*:*:*:*:*:*", "match_criteria_id": "95CE35FC-266F-4025-A0B8-FB853C020800", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*", "match_criteria_id": "6172AF57-B26D-45F8-BE3A-F75ABDF28F49", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*", "match_criteria_id": "1D8B549B-E57B-4DFE-8A13-CAB06B5356B3", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*", "match_criteria_id": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "match_criteria_id": "142AD0DD-4CF3-4D74-9442-459CE3347E3A", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*", "match_criteria_id": "133AAFA7-AF42-4D7B-8822-AA2E85611BF5", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "match_criteria_id": "EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*", "match_criteria_id": "33C068A4-3780-4EAB-A937-6082DF847564", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*", "match_criteria_id": "6252E88C-27FF-420D-A64A-C34124CF7E6A", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:suse:studio_onsite:1.3:*:*:*:*:*:*:*", "match_criteria_id": "74BCA435-7594-49E8-9BAE-9E02E129B6C0", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*", "match_criteria_id": "DFBF430B-0832-44B0-AA0E-BA9E467F7668", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*", "match_criteria_id": "A10BC294-9196-425F-9FB0-B1625465B47F", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*", "match_criteria_id": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*", "match_criteria_id": "3ED68ADD-BBDA-4485-BC76-58F011D72311", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*", "match_criteria_id": "D2DF4815-B8CB-4AD3-B91D-2E09A8E318E9", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:ltss:*:*:*", "match_criteria_id": "CED02712-1031-4206-AC4D-E68710F46EC9", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:ltss:*:*:*", "match_criteria_id": "35BBD83D-BDC7-4678-BE94-639F59281139", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:-:*:*", "match_criteria_id": "7F4AF9EC-7C74-40C3-A1BA-82B80C4A7EE0", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*", "match_criteria_id": "CB6476C7-03F2-4939-AB85-69AA524516D9", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "match_criteria_id": "16F59A04-14CF-49E2-9973-645477EA09DA", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:ibm:infosphere_guardium_database_activity_monitoring:8.2:*:*:*:*:*:*:*", "match_criteria_id": "94C9C346-6DEC-4C72-9F59-BB3BEC42B551", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:ibm:infosphere_guardium_database_activity_monitoring:9.0:*:*:*:*:*:*:*", "match_criteria_id": "2071DABB-7102-47F2-A15F-A6C03607D01F", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:ibm:infosphere_guardium_database_activity_monitoring:9.1:*:*:*:*:*:*:*", "match_criteria_id": "A8661E86-E075-427F-8E05-7A33811A3A76", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:ibm:pureapplication_system:*:*:*:*:*:*:*:*", "match_criteria_id": "BEFCC35D-1C83-4CA5-8B1D-9A637613AD7E", "version_start_including": "1.0.0.0", "version_start_excluding": null, "version_end_including": "1.0.0.4", "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:ibm:pureapplication_system:*:*:*:*:*:*:*:*", "match_criteria_id": "054736AF-96E0-491D-B824-CC4A35B76E14", "version_start_including": "1.1.0.0", "version_start_excluding": null, "version_end_including": "1.1.0.4", "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:ibm:pureapplication_system:2.0.0.0:*:*:*:*:*:*:*", "match_criteria_id": "575894EE-F13C-4D56-8B63-59A379F63BD2", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:ibm:qradar_risk_manager:7.1.0:*:*:*:*:*:*:*", "match_criteria_id": "0E476AEB-AD38-4033-8426-DC502497D75A", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.0:*:*:*:*:*:*:*", "match_criteria_id": "3C062C89-5DC2-46EE-A9D3-23E7539A5DAF", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.0:mr1:*:*:*:*:*:*", "match_criteria_id": "20981443-6A64-4852-B2CB-3299927C6F78", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.1.0:mr2:*:*:*:*:*:*", "match_criteria_id": "59761BB8-FCC7-4D15-88A8-82076CCF196F", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:*", "match_criteria_id": "3CB18F38-AC6A-406A-A4DD-40688B803744", "version_start_including": "1.1.0.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.4.3.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:*", "match_criteria_id": "DFE781C8-40F7-4F6D-8FED-8EB3071FE9DB", "version_start_including": "1.5.0.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.5.0.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:*", "match_criteria_id": "A5AB3395-B458-49F8-A8E3-25FF0C1C3BD3", "version_start_including": "7.2.0.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "7.2.0.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:*", "match_criteria_id": "1EC57FAE-AD4D-4C9F-97A4-581C977B5FE4", "version_start_including": "7.3.0.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "7.3.0.7" } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:ibm:storwize_v7000:-:*:*:*:*:*:*:*", "match_criteria_id": "AA2ED020-4C7B-4303-ABE6-74D46D127556", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:gnu:bash:*:*:*:*:*:*:*:*", "vendor": "gnu", "product": "bash", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": "4.3", "version_end_excluding": null, "affected_versions_first": "1.14.0", "affected_versions_last": "4.3", "affected_versions": [ "-", "1.14.0", "1.14.1", "1.14.2", "1.14.3", "1.14.4", "1.14.5", "1.14.6", "1.14.7", "2.0" ], "cpe_names": [ { "cpe_name": "cpe:2.3:a:gnu:bash:-:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:gnu:bash:1.14.0:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:gnu:bash:1.14.1:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:gnu:bash:1.14.2:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:gnu:bash:1.14.3:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:gnu:bash:1.14.4:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:gnu:bash:1.14.5:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:gnu:bash:1.14.6:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:gnu:bash:1.14.7:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:gnu:bash:2.0:*:*:*:*:*:*:*", "deprecated": false } ] }, { "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "vendor": "arista", "product": "eos", "product_type": "o", "vulnerable": true, "version_start_including": "4.9.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.9.12", "affected_versions_first": "4.9.0", "affected_versions_last": "4.9.0", "affected_versions": [ "4.9.0" ], "cpe_names": [ { "cpe_name": "cpe:2.3:o:arista:eos:4.9.0:*:*:*:*:*:*:*", "deprecated": false } ] }, { "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "vendor": "arista", "product": "eos", "product_type": "o", "vulnerable": true, "version_start_including": "4.10.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.10.9", "affected_versions_first": "4.10.0", "affected_versions_last": "4.10.0", "affected_versions": [ "4.10.0" ], "cpe_names": [ { "cpe_name": "cpe:2.3:o:arista:eos:4.10.0:*:*:*:*:*:*:*", "deprecated": false } ] }, { "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "vendor": "arista", "product": "eos", "product_type": "o", "vulnerable": true, "version_start_including": "4.11.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.11.11", "affected_versions_first": "4.11.0", "affected_versions_last": "4.11.0", "affected_versions": [ "4.11.0" ], "cpe_names": [ { "cpe_name": "cpe:2.3:o:arista:eos:4.11.0:*:*:*:*:*:*:*", "deprecated": false } ] }, { "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "vendor": "arista", "product": "eos", "product_type": "o", "vulnerable": true, "version_start_including": "4.12.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.12.9", "affected_versions_first": "4.12.0", "affected_versions_last": "4.12.0", "affected_versions": [ "4.12.0" ], "cpe_names": [ { "cpe_name": "cpe:2.3:o:arista:eos:4.12.0:*:*:*:*:*:*:*", "deprecated": false } ] }, { "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "vendor": "arista", "product": "eos", "product_type": "o", "vulnerable": true, "version_start_including": "4.13.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.13.9", "affected_versions_first": "4.13.0", "affected_versions_last": "4.13.0", "affected_versions": [ "4.13.0" ], "cpe_names": [ { "cpe_name": "cpe:2.3:o:arista:eos:4.13.0:*:*:*:*:*:*:*", "deprecated": false } ] }, { "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "vendor": "arista", "product": "eos", "product_type": "o", "vulnerable": true, "version_start_including": "4.14.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.14.4f", "affected_versions_first": "4.14.0", "affected_versions_last": "4.14.0", "affected_versions": [ "4.14.0" ], "cpe_names": [ { "cpe_name": "cpe:2.3:o:arista:eos:4.14.0:*:*:*:*:*:*:*", "deprecated": false } ] }, { "criteria": "cpe:2.3:o:oracle:linux:4:*:*:*:*:*:*:*", "vendor": "oracle", "product": "linux", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "4", "affected_versions_last": "4", "affected_versions": [ "4" ], "cpe_names": [ { "cpe_name": "cpe:2.3:o:oracle:linux:4:*:*:*:*:*:*:*", "deprecated": false } ] }, { "criteria": "cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*", "vendor": "oracle", "product": "linux", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "5", "affected_versions_last": "5", "affected_versions": [ "5" ], "cpe_names": [ { "cpe_name": "cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*", "deprecated": false } ] }, { "criteria": "cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*", "vendor": "oracle", "product": "linux", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "6", "affected_versions_last": "6", "affected_versions": [ "6" ], "cpe_names": [ { "cpe_name": "cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*", "deprecated": false } ] } ], "cwe": [ { "id": 78, "owasptop10_2021": "A03 Injection", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "description": "The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.", "capec_id": [ 6, 15, 43, 88, 108 ], "scope": [ "Availability", "Confidentiality", "Integrity", "Non-Repudiation" ], "impact": [ "DoS: Crash, Exit, or Restart", "Execute Unauthorized Code or Commands", "Hide Activities", "Modify Application Data", "Modify Files or Directories", "Read Application Data", "Read Files or Directories" ], "detection_method": [ "Architecture or Design Review", "Automated Dynamic Analysis", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Static Analysis", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.99999, "percentile": 0.99993, "date": "2026-09-23" }, "cisa_kev": { "vendor_project": "GNU", "product": "Bourne-Again Shell (Bash)", "vulnerability_name": "GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability", "date_added": "2022-01-28", "short_description": "GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.", "required_action": "Apply updates per vendor instructions.", "due_date": "2022-07-28", "known_ransomware_campaign_use": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2014-6271" }, "vdeep_metric": { "available_versions": [ "3.1", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 9.8, "base_severity": "CRITICAL" } } } } ``` ## Related Examples - [Heartbleed (CVE-2014-0160)](/reference/vulnerability/detail/examples/cve-2014-0160/) - [EternalBlue (CVE-2017-0144)](/reference/vulnerability/detail/examples/cve-2017-0144/) - [Log4Shell (CVE-2021-44228)](/reference/vulnerability/detail/examples/cve-2021-44228/) - [Citrix Bleed (CVE-2023-4966)](/reference/vulnerability/detail/examples/cve-2023-4966/) - [XZ Utils Backdoor (CVE-2024-3094)](/reference/vulnerability/detail/examples/cve-2024-3094/) - [OpenSSH regreSSHion (CVE-2024-6387)](/reference/vulnerability/detail/examples/cve-2024-6387/)