tac_plus-pre-auth-rce

Уязвимость удалённого выполнения команд до аутентификации в tacplus Этот репозиторий содержит информацию об уязвимости удалённого выполнения команд до аутентификации в различных реализациях tacplus с открытым исходным кодом. Затронуты следующие два форка: Shrubbery Networks tacplus Facebook tacpl...

CVE-2023-48643

Shrubbery tacplus 2.x, 3.x. and 4.x through F4.0.4.28 allows unauthenticated Remote Command Execution. The product allows users to configure authorization checks as shell commands through the tacplus.cfg configuration file. These are executed when a client sends an authorization request with a...

CVE-2023-48643

Shrubbery tac_plus versions 2.x, 3.x, and 4.x through F4.0.4.28 are vulnerable to unauthenticated Remote Command Execution (RCE) . The root cause is the improper handling of TACACS+ packet strings, which are used as command-line arguments in shell commands configured via the tac_plus.cfg file. An...

CVE-2023-48643

Shrubbery tacplus 2.x, 3.x. and 4.x through F4.0.4.28 allows unauthenticated Remote Command Execution. The product allows users to configure authorization checks as shell commands through the tacplus.cfg configuration file. These are executed when a client sends an authorization request with a...

PT-2024-13615 · Shrubbery · Tac Plus

Name of the Vulnerable Software and Affected Versions: Shrubbery tac plus versions 2.x through 4.x and versions up to F4.0.4.28 Description: The issue allows unauthenticated Remote Command Execution. It is caused by the product's ability to configure authorization checks as shell commands through...

CVE-2023-48643: Improper Control of Generation of Code

Shrubbery tacplus 2.x, 3.x. and 4.x through F4.0.4.28 allows unauthenticated Remote Command Execution. The product allows users to configure authorization checks as shell commands through the tacplus.cfg configuration file. These are executed when a client sends an authorization request with a...