Lucene search

[email protected]CVE-2008-4318

HistorySep 29, 2008 - 7:25 p.m.

CVE-2008-4318

2008-09-2919:25:32

CWE-20

[email protected]

web.nvd.nist.gov

cve-2008-4318

observer

remote attackers

arbitrary commands

shell metacharacters

whois.php

netcmd.php

nvd

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

7.7 High

AI Score

Confidence

High

0.009 Low

EPSS

Percentile

82.4%

JSON

Observer 0.3.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter to (1) whois.php or (2) netcmd.php.

Affected configurations

NVD

Node

project-observerobserverRange≤0.3.2.1

project-observerobserverMatch0.1.0

project-observerobserverMatch0.1.1

project-observerobserverMatch0.1.2

project-observerobserverMatch0.2.0

project-observerobserverMatch0.2.1

project-observerobserverMatch0.2.2

project-observerobserverMatch0.2.3

project-observerobserverMatch0.2.4

project-observerobserverMatch0.2.5

project-observerobserverMatch0.3.1

project-observerobserverMatch0.3.2

project-observerobserverMatch0.30-pre-1

CPENameOperatorVersion
project-observer:observerproject-observer observerle0.3.2.1
project-observer:observerproject-observer observereq0.1.0
project-observer:observerproject-observer observereq0.1.1
project-observer:observerproject-observer observereq0.1.2
project-observer:observerproject-observer observereq0.2.0
project-observer:observerproject-observer observereq0.2.1
project-observer:observerproject-observer observereq0.2.2
project-observer:observerproject-observer observereq0.2.3
project-observer:observerproject-observer observereq0.2.4
project-observer:observerproject-observer observereq0.2.5

CPE	Name	Operator	Version
project-observer:observer	project-observer observer	le	0.3.2.1
project-observer:observer	project-observer observer	eq	0.1.0
project-observer:observer	project-observer observer	eq	0.1.1
project-observer:observer	project-observer observer	eq	0.1.2
project-observer:observer	project-observer observer	eq	0.2.0
project-observer:observer	project-observer observer	eq	0.2.1
project-observer:observer	project-observer observer	eq	0.2.2
project-observer:observer	project-observer observer	eq	0.2.3
project-observer:observer	project-observer observer	eq	0.2.4
project-observer:observer	project-observer observer	eq	0.2.5

Rows per page:

1-10 of 131

References

securityreason.com/securityalert/4322

exchange.xforce.ibmcloud.com/vulnerabilities/45398

www.exploit-db.com/exploits/6559

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

7.7 High

AI Score

Confidence

High

0.009 Low

EPSS

Percentile

82.4%

JSON

Related for CVE-2008-4318

cvelist1 nvd1 prion1