Lucene search

K
nvd[email protected]NVD:CVE-2024-28033
HistoryMar 26, 2024 - 10:15 a.m.

CVE-2024-28033

2024-03-2610:15:09
CWE-78
web.nvd.nist.gov
2
cve-2024-28033
webproxy
remote attacker
arbitrary os command
privilege escalation
developer unreachable
stop using

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

7.6

Confidence

High

EPSS

0

Percentile

9.0%

OS command injection vulnerability exists in WebProxy 1.7.8 and 1.7.9, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the privilege of the running web server. Note that the developer was unreachable, therefore, users should consider stop using WebProxy 1.7.8 and 1.7.9.

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

7.6

Confidence

High

EPSS

0

Percentile

9.0%

Related for NVD:CVE-2024-28033