CVE-2020-15477

Name of the Vulnerable Software and Affected Versions RaspberryTortoise versions prior to 2012-10-28

Description The issue allows for remote code execution via shell metacharacters in a URI. Specifically, the file nodejs/raspberryTortoise.js lacks validation on the incomingString parameter before it is passed to the child process.exec function.

Recommendations For versions prior to 2012-10-28, consider validating the incomingString parameter to prevent shell metacharacters from being executed. As a temporary workaround, restrict access to the child process.exec function until a proper fix can be applied.