CVE-2023-34105

Name of the Vulnerable Software and Affected Versions SRS versions prior to 5.0.157 SRS versions prior to 5.0-b1 SRS versions prior to 6.0.48

Description The issue concerns a drive-by command injection in the api-server server. An attacker can send a request to the "/api/v1/snapshots" endpoint with any commands to be executed as part of the body of the POST request, potentially leading to Remote Code Execution (RCE).

Recommendations For versions prior to 5.0.157, update to version 5.0.157 or later. For versions prior to 5.0-b1, update to version 5.0-b1 or later. For versions prior to 6.0.48, update to version 6.0.48 or later.