Lucene search

GitHub_MCVELIST:CVE-2023-38692

HistoryAug 04, 2023 - 5:22 p.m.

CVE-2023-38692 Command injection vulnerability in module management function in CloudExplorer Lite

2023-08-0417:22:39

CWE-78

GitHub_M

www.cve.org

cve-2023-38692

command injection

cloudexplorer lite

module management

vulnerability

installation

upgrade

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

35.6%

JSON

CloudExplorer Lite is an open source, lightweight cloud management platform. Versions prior to 1.3.1 contain a command injection vulnerability in the installation function in module management. The vulnerability has been fixed in v1.3.1. There are no known workarounds aside from upgrading.

CNA Affected

[
  {
    "vendor": "CloudExplorer-Dev",
    "product": "CloudExplorer-Lite",
    "versions": [
      {
        "version": "< 1.3.1",
        "status": "affected"
      }
    ]
  }
]

References

github.com/CloudExplorer-Dev/CloudExplorer-Lite/blob/v1.3.0/framework/management-center/backend/src/main/java/com/fit2cloud/controller/ModuleManageController.java

github.com/CloudExplorer-Dev/CloudExplorer-Lite/releases/tag/v1.3.1

github.com/CloudExplorer-Dev/CloudExplorer-Lite/security/advisories/GHSA-7wrc-f42m-9v5w

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

35.6%

JSON

Related for CVELIST:CVE-2023-38692