CVE-2023-6004

[CVE catalog]

Severity

Medium · CVSS 4.8CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Published

Dec 18, 2023, 11:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.45% · Oct 25, 2026

A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter. libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname Despite the potential severity of this issue, the requirement for user interaction to exploit the vulnerability has led to a low severity rating. As a precautionary measure, users are advised to sanitize hostname inputs as a mitigation strategy. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.