10

CVE-2007-3010

Warnung
Exploit
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)

15.04.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability

Schwachstelle

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 97.41% 0.999
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

http://marc.info/?l=full-disclosure&m=119002152126755&w=2
Exploit
Mailing List
http://osvdb.org/40521
Broken Link
http://secunia.com/advisories/26853
Vendor Advisory
Broken Link
http://www.redteam-pentesting.de/advisories/rt-sa-2007-001.php
Broken Link
http://www.securityfocus.com/archive/1/479699/100/0/threaded
Third Party Advisory
Broken Link
VDB Entry
http://www.securityfocus.com/bid/25694
Third Party Advisory
Broken Link
VDB Entry
http://www.vupen.com/english/advisories/2007/3185
Broken Link
http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm
Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/36632
Third Party Advisory
VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2007-3010
US Government Resource