title: Imperative Local Command Injection allows Activity Masking
description: A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI.
affected:
{
vendor: Open Mainframe Project
product: Zowe
versions:
version: 1.16.0, status: affected, lessThan: 1.28.2, versionType: semver
version: 2.0.0, status: affected, lessThan: 2.5.0, versionType: semver
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
baseScore: 3.3
baseSeverity: LOW
version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C/CR:L/IR:X/AR:X/MAV:L/MAC:L/MPR:L/MUI:N/MS:U/MC:L/MI:X/MA:X
]
exploits: There are no known exploits of this issue.
solutions: This issue is fixed in Zowe 1.28.2 or later, and Zowe 2.5.0 or later.