Описание
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands.
Ссылки
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Broken LinkThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Broken LinkThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 4.2.0.1 (исключая)Версия до 4.2.0.1 (исключая)
Одно из
cpe:2.3:a:vembu:bdr_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:vembu:offsite_dr:*:*:*:*:*:*:*:*
EPSS
Процентиль: 92%
0.07871
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
NVD-CWE-noinfo
Связанные уязвимости
CVSS3: 9.8
github
больше 3 лет назад
Vembu BDR Suite before 4.2.0 allows Unauthenticated Remote Code Execution by placing a command in a GET request (issue 1 of 2).
EPSS
Процентиль: 92%
0.07871
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
NVD-CWE-noinfo