CVE-2020-13448

Опубликовано: 01 июн. 2020

Источник: nvd

CVSS3: 8.8

CVSS2: 9

EPSS Средний

Описание

QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server via command injection in the servicestart parameter.

Ссылки

http://packetstormsecurity.com/files/157898/QuickBox-Pro-2.1.8-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://s1gh.sh/cve-2020-13448-quickbox-authenticated-rce/
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/157898/QuickBox-Pro-2.1.8-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://s1gh.sh/cve-2020-13448-quickbox-authenticated-rce/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:quickbox:quickbox:*:*:*:*:community:*:*:*

Версия до 2.5.5 (включая)

Конфигурация 2

cpe:2.3:a:quickbox:quickbox:*:*:*:*:pro:*:*:*

Версия до 2.1.8 (включая)

EPSS

Процентиль: 97%

0.40223

Средний

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-2795-85x7-cp8v

github

больше 3 лет назад