Code injection

2014-10-2500:55:00

PRIOn knowledge base

www.prio-n.com

7.7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, which allows local users to execute arbitrary Perl code by modifying these files.

CPENameOperatorVersion
electriccommandereq5.0.0
electriccommanderle4.2.5
electriccommandereq5.0.1
electriccommandereq5.0.2

Name	Operator	Version
electriccommander	eq	5.0.0
electriccommander	le	4.2.5
electriccommander	eq	5.0.1
electriccommander	eq	5.0.2

References

docs.electric-cloud.com/commander_doc/5_0_3/HTML5/ReleaseNotes/commander_releasenotes.htm

packetstormsecurity.com/files/128819/ElectricCommander-4.2.4.71224-Privilege-Escalation.html

seclists.org/fulldisclosure/2014/Oct/104

www.securityfocus.com/bid/70722

exchange.xforce.ibmcloud.com/vulnerabilities/97735

www.secureworks.com/advisories/SWRX-2014-010/SWRX-2014-010.pdf

www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2014-010/