CVE-2003-1308 describes a CRLF injection vulnerability in fvwm-menu-directory affecting FVWM versions 2.5.x prior to 2.5.10 and 2.4.x prior to 2.4.18. This flaw allows local users to execute arbitrary commands by injecting carriage returns into filenames. With a CVSS score of 4.6, this vulnerability is of medium severity, requiring local access with low attack complexity, and potentially leading to compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog and lacking active exploitation, an ExploitDB entry (EDB-23414) confirms the existence of exploit code, though there is no significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.4.17CPE matchmatch criteria | cpe:2.3:a:fvwm:fvwm:*:*:*:*:*:*:*:* | ||
<= 2.5.8CPE matchmatch criteria | cpe:2.3:a:fvwm:fvwm:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:L/AC:L/Au:N/C:P/I:P/A:P
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.