CVE-2023-3260

EPSS 1.26%
Veröffentlicht 14.08.2023 04:15:10
Zuletzt bearbeitet 21.11.2024 08:16:49
Erkennungen
Login

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter. An authenticated malicious agent can exploit this vulnerability to execute arbitrary command on the underlying Linux operating system.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 23 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Cyberpower ≫ Powerpanel Server SwEdition enterprise Version < 2.6.9

Dataprobe ≫ Iboot-pdu4a-c10 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu4a-c10 Version -

Dataprobe ≫ Iboot-pdu4a-c20 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu4a-c20 Version -

Dataprobe ≫ Iboot-pdu4a-n15 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu4a-n15 Version -

Dataprobe ≫ Iboot-pdu4a-n20 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu4a-n20 Version -

Dataprobe ≫ Iboot-pdu4-c20 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu4-c20 Version -

Dataprobe ≫ Iboot-pdu4-n20 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu4-n20 Version -

Dataprobe ≫ Iboot-pdu4sa-c10 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu4sa-c10 Version -

Dataprobe ≫ Iboot-pdu4sa-c20 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu4sa-c20 Version -

Dataprobe ≫ Iboot-pdu4sa-n15 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu4sa-n15 Version -

Dataprobe ≫ Iboot-pdu4sa-n20 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu4sa-n20 Version -

Dataprobe ≫ Iboot-pdu8a-2c10 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu8a-2c10 Version -

Dataprobe ≫ Iboot-pdu8a-2c20 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu8a-2c20 Version -

Dataprobe ≫ Iboot-pdu8a-2n15 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu8a-2n15 Version -

Dataprobe ≫ Iboot-pdu8a-2n20 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu8a-2n20 Version -

Dataprobe ≫ Iboot-pdu8a-c10 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu8a-c10 Version -

Dataprobe ≫ Iboot-pdu8a-c20 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu8a-c20 Version -

Dataprobe ≫ Iboot-pdu8a-n15 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu8a-n15 Version -

Dataprobe ≫ Iboot-pdu8a-n20 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu8a-n20 Version -

Dataprobe ≫ Iboot-pdu8sa-2n15 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu8sa-2n15 Version -

Dataprobe ≫ Iboot-pdu8sa-c10 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu8sa-c10 Version -

Dataprobe ≫ Iboot-pdu8sa-n15 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu8sa-n15 Version -

Dataprobe ≫ Iboot-pdu8sa-n20 Firmware Version < 1.44.0804202

Dataprobe ≫ Iboot-pdu8sa-n20 Version -

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.26%	0.671

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Trellix	7.2	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-3260

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-3260

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-3260

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2023-3260