Описание
GlobalProtect-openconnect versions prior to 1.4.3 are affected by incorrect access control in GPService through DBUS, GUI Application. The way GlobalProtect-Openconnect is set up enables arbitrary users to execute commands as root by submitting the --script=<script> parameter.
Ссылки
- ExploitIssue TrackingMitigationThird Party Advisory
- ExploitIssue TrackingMitigationThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.4.3 (исключая)
cpe:2.3:a:globalprotect-openconnect_project:globalprotect-openconnect:*:*:*:*:*:*:*:*
EPSS
Процентиль: 77%
0.01048
Низкий
9.8 Critical
CVSS3
10 Critical
CVSS2
Дефекты
NVD-CWE-noinfo
Связанные уязвимости
CVSS3: 9.8
github
почти 4 года назад
Multiple versions of GlobalProtect-openconnect are affected by incorrect access control in GPService through DBUS, GUI Application. The way GlobalProtect-Openconnect is set up enables arbitrary users to execute commands as root by submitting the `--script=<script>` parameter.
EPSS
Процентиль: 77%
0.01048
Низкий
9.8 Critical
CVSS3
10 Critical
CVSS2
Дефекты
NVD-CWE-noinfo