CVE-2017-17515

CVE-2017-17515 describes an argument-injection vulnerability in Metview 4.7.3's etc/ObjectList component, affecting Debian and ECMWF Metview distributions. The vulnerability arises from a lack of validation for strings before launching the program specified by the BROWSER environment variable, potentially allowing remote attackers to inject malicious arguments via a crafted URL. Rated 8.8 HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), this flaw is easily exploitable over a network with low attack complexity, requiring user interaction, and could lead to high impact on confidentiality, integrity, and availability. Despite its severity, there is no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage, though a third party noted the relevant code might not be enabled in shipped products.