PT-2020-10313
CVE-2019-19994
·
تاريخ النشر
2020-02-26
·
تاريخ التحديث
2020-02-27
الوصف من
CVSS 2.0
10
حرجةالمقاييسAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29
Description
An issue in Selesta Visual Access Manager allows blind Command Injection, enabling an attacker without authentication to execute arbitrary operating system commands. This is achieved by injecting a vulnerable parameter in the PHP Web page /common/vam monitor sap.php.
Recommendations
For versions 4.15.0 through 4.29, consider restricting access to the /common/vam monitor sap.php endpoint until a fix is available, and avoid using the vulnerable parameter to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾