Argument injection vulnerability in the URI handler in... · CVE-2006-2312 · GitHub Advisory Database · GitHub

Argument injection vulnerability in the URI handler in...

Low severity Unreviewed Published May 1, 2022 to the GitHub Advisory Database • Updated Feb 22, 2024

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

Argument injection vulnerability in the URI handler in Skype 2.0..104 and 2.5..0 through 2.5.*.78 for Windows allows remote authorized attackers to download arbitrary files via a URL that contains certain command-line switches.

References

Published by the National Vulnerability Database

May 19, 2006

Published to the GitHub Advisory Database May 1, 2022

Last updated Feb 22, 2024

Weaknesses

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. Learn more on MITRE.

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. Learn more on MITRE.