8.8

CVE-2018-16232

Exploit
An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi. This allows an authenticated user with privileges for the affected page to execute arbitrary commands.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ipfire ≫ Ipfire Version1.49
Ipfire ≫ Ipfire Version2.1
Ipfire ≫ Ipfire Version2.1 Updatecore_update16
Ipfire ≫ Ipfire Version2.11 Updatecore_update53
Ipfire ≫ Ipfire Version2.11 Updatecore_update54
Ipfire ≫ Ipfire Version2.11 Updatecore_update59
Ipfire ≫ Ipfire Version2.11 Updatecore_update60
Ipfire ≫ Ipfire Version2.11 Updatecore_update62
Ipfire ≫ Ipfire Version2.11 Updatecore_update64
Ipfire ≫ Ipfire Version2.13 Updatecore_update66
Ipfire ≫ Ipfire Version2.13 Updatecore_update67
Ipfire ≫ Ipfire Version2.13 Updatecore_update71
Ipfire ≫ Ipfire Version2.13 Updatecore_update72
Ipfire ≫ Ipfire Version2.13 Updatecore_update73
Ipfire ≫ Ipfire Version2.13 Updatecore_update74
Ipfire ≫ Ipfire Version2.13 Updatecore_update75
Ipfire ≫ Ipfire Version2.13 Updatecore_update76
Ipfire ≫ Ipfire Version2.13 Updaterc_1
Ipfire ≫ Ipfire Version2.13 Updaterc_2
Ipfire ≫ Ipfire Version2.15 Update76_rc1
Ipfire ≫ Ipfire Version2.15 Update77_rc1
Ipfire ≫ Ipfire Version2.15 Update77_rc2
Ipfire ≫ Ipfire Version2.15 Updatecore_update79
Ipfire ≫ Ipfire Version2.15 Updatecore_update81
Ipfire ≫ Ipfire Version2.15 Updatecore_update82
Ipfire ≫ Ipfire Version2.15 Updatecore_update83
Ipfire ≫ Ipfire Version2.15 Updatecore_update84
Ipfire ≫ Ipfire Version2.15 Updatecore_update85
Ipfire ≫ Ipfire Version2.17 Update86_beta1
Ipfire ≫ Ipfire Version2.17 Update87_rc1
Ipfire ≫ Ipfire Version2.17 Updatecore_update88
Ipfire ≫ Ipfire Version2.17 Updatecore_update89
Ipfire ≫ Ipfire Version2.17 Updatecore_update91
Ipfire ≫ Ipfire Version2.17 Updatecore_update93
Ipfire ≫ Ipfire Version2.17 Updatecore_update95
Ipfire ≫ Ipfire Version2.17 Updatecore_update97
Ipfire ≫ Ipfire Version2.17 Updatecore_update98
Ipfire ≫ Ipfire Version2.17 Updatecore_update99
Ipfire ≫ Ipfire Version2.19 Updatecore_update100
Ipfire ≫ Ipfire Version2.19 Updatecore_update101
Ipfire ≫ Ipfire Version2.19 Updatecore_update102
Ipfire ≫ Ipfire Version2.19 Updatecore_update105
Ipfire ≫ Ipfire Version2.19 Updatecore_update106
Ipfire ≫ Ipfire Version2.19 Updatecore_update107
Ipfire ≫ Ipfire Version2.19 Updatecore_update108
Ipfire ≫ Ipfire Version2.19 Updatecore_update111
Ipfire ≫ Ipfire Version2.19 Updatecore_update112
Ipfire ≫ Ipfire Version2.19 Updatecore_update113
Ipfire ≫ Ipfire Version2.19 Updatecore_update114
Ipfire ≫ Ipfire Version2.19 Updatecore_update116
Ipfire ≫ Ipfire Version2.19 Updatecore_update117
Ipfire ≫ Ipfire Version2.19 Updatecore_update118
Ipfire ≫ Ipfire Version2.19 Updatecore_update119
Ipfire ≫ Ipfire Version2.19 Updatecore_update120
Ipfire ≫ Ipfire Version2.21 Updatecore_update122
Ipfire ≫ Ipfire Version2.21 Updatecore_update123
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 38.48% 0.969
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.