CVE-2018-14417

A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv script did not sanitize the 'recentVersion' parameter from the snserv endpoint, allowing an unauthenticated attacker to execute arbitrary commands with root...

CVE-2018-14417: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv script did not sanitize the 'recentVersion' parameter from the snserv endpoint, allowing an unauthenticated attacker to execute arbitrary commands with root...

PT-2018-12498

Name of the Vulnerable Software and Affected Versions SoftNAS Cloud versions prior to 4.0.3 Description A command injection issue was discovered in the web administration console. Specifically, the snserv script failed to sanitize the recentVersion parameter from the "snserv endpoint", allowing a...