PT-2020-13652
CVE-2020-13694
·
تاريخ النشر
2020-06-01
·
تاريخ التحديث
2020-06-02
الوصف من
CVSS 2.0
9.0
عاليةالمقاييسAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
QuickBox Community Edition versions 2.5.5 and earlier
QuickBox Pro Edition versions 2.1.8 and earlier
Description
The issue allows the local www-data user to execute sudo mysql without a password. This means the www-data user can execute arbitrary OS commands via the mysql -e option.
Recommendations
For QuickBox Community Edition versions 2.5.5 and earlier, update to a version where this issue is fixed.
For QuickBox Pro Edition versions 2.1.8 and earlier, update to a version where this issue is fixed.
As a temporary workaround, consider restricting the
www-data user's access to the mysql command until a patch is available.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾