10

CVE-2018-1000666

Exploit
GIG Technology NV JumpScale Portal 7 version before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in method: notifySpaceModification; that can result in Improper validation of parameters results in command execution. This attack appear to be exploitable via Network connectivity, required minimal auth privileges (everyone can register an account). This vulnerability appears to have been fixed in After commit 15443122ed2b1cbfd7bdefc048bf106f075becdb.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Openvcloud Project ≫ Openvcloud Version < 2.3.0
Gig ≫ Jumpscale Version7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 8.08% 0.941
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://github.com/0-complexity/openvcloud/issues/1207
Third Party Advisory
Exploit
Issue Tracking
https://github.com/jumpscale7/jumpscale_portal/blob/c997bb1824862b08246d60e34e950df06ebac68c/apps/portalbase/system/system__contentmanager/methodclass/system_contentmanager.py#L293-L315
Third Party Advisory
Exploit
https://github.com/jumpscale7/jumpscale_portal/pull/108
Broken Link
https://medium.com/%40vrico315/vulnerability-in-jumpscale-portal-7-a88098a1caca
https://telegra.ph/Description-of-vulnerability-in-JumpScale-Portal-7-08-23
Third Party Advisory
Exploit