CVE-2022-39986
CRITICAL9.8EPSS 93.1%RaspAP Command Injection vulnerability
發布日:2023/8/1修改日:2024/2/16
描述
A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the `cfg_id` parameter in `/ajax/openvpn/activate_ovpncfg.php` and `/ajax/openvpn/del_ovpncfg.php`.
受影響套件(1)
- Packagist/billz/raspap-webgui>= 2.8.0, < 2.8.8
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
參考連結(6)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-39986
- PATCHhttps://github.com/RaspAP/raspap-webgui
- WEBhttps://github.com/RaspAP/raspap-webgui/blob/master/ajax/openvpn/activate_ovpncfg.php
- WEBhttps://github.com/RaspAP/raspap-webgui/commit/1fabc481690e008279113e18d0642c5279e3b56e
- WEBhttps://github.com/RaspAP/raspap-webgui/pull/1303
- WEBhttps://medium.com/@ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2