Описание
An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM server from List control, and execute the arbitrary code on the same system where SCMArchivedEventViewerTool is installed in the case of SCM Tools.
EPSS
Процентиль: 51%
0.00281
Низкий
7.5 High
CVSS3
Дефекты
CWE-94
Связанные уязвимости
CVSS3: 7.5
github
почти 2 года назад
Authenticated List control client can execute the LINQ query in SCM Server to present event as list for operator. An authenticated malicious client can send special LINQ query to execute arbitrary code remotely (RCE) on the SCM Server that an attacker otherwise does not have authorization to do.
EPSS
Процентиль: 51%
0.00281
Низкий
7.5 High
CVSS3
Дефекты
CWE-94