Lucene search

GoogleOSV:CVE-2023-30260

HistoryJun 23, 2023 - 12:15 p.m.

CVE-2023-30260

2023-06-2312:15:09

Google

osv.dev

cve-2023-30260

raspap

command injection

remote attackers

arbitrary commands

crafted post request

hostapd settings form

software

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.9 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

34.2%

JSON

Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.

CPENameOperatorVersion
raspap-webguieq2.6.3
raspap-webguieq2.6.4
raspap-webguieq2.8.2
raspap-webguieq1.2.1
raspap-webguieq2.8.0
raspap-webguieq2.5.1
raspap-webguieq2.8.6
raspap-webguieq1.0
raspap-webguieq2.8.4
raspap-webguieq1.5.1

Name	Operator	Version
raspap-webgui	eq	2.6.3
raspap-webgui	eq	2.6.4
raspap-webgui	eq	2.8.2
raspap-webgui	eq	1.2.1
raspap-webgui	eq	2.8.0
raspap-webgui	eq	2.5.1
raspap-webgui	eq	2.8.6
raspap-webgui	eq	1.0
raspap-webgui	eq	2.8.4
raspap-webgui	eq	1.5.1

Rows per page:

1-10 of 461

References

eldstal.se/advisories/230328-raspap.html

github.com/RaspAP/raspap-webgui/pull/1322

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.9 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

34.2%

JSON

Related for OSV:CVE-2023-30260