Ubuntu.comUB:CVE-2023-38316CVE-2023-38316
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.6 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
30.1%
An issue was discovered in OpenNDS Captive Portal before version 10.1.2.
When the custom unescape callback is enabled, attackers can execute
arbitrary OS commands by inserting them into the URL portion of HTTP GET
requests.
Bugs
References
github.com/openNDS/openNDS/commit/cd4004fc3cf79c0f2bc0ee98db30d225d0b79bc9 (v10.1.2)
launchpad.net/bugs/cve/CVE-2023-38316
nvd.nist.gov/vuln/detail/CVE-2023-38316
security-tracker.debian.org/tracker/CVE-2023-38316
source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2023-006-r3.ashx
www.cve.org/CVERecord?id=CVE-2023-38316
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.6 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
30.1%