Remote Code Execution (RCE)

2019-01-1509:02:24

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

53.1%

JSON

luci is vulnerable to remote code execution (RCE) attacks. The vulnerability exists through an eval injection vulnerability in luci 0.26.0 allows remote authenticated users with certain permissions to execute arbitrary Python code via a crafted cluster configuration.

CPENameOperatorVersion
lucieq0.26.0__37.el6
lucieq0.26.0__37.el6_4.1
lucieq0.23.0__13.el6
lucieq0.26.0__48.el6
lucieq0.26.0__13.el6
lucieq0.22.2__14.el6_0.1
lucieq0.23.0__32.el6
lucieq0.22.2__14.el6
lucieq0.26.0__37.el6
lucieq0.26.0__37.el6_4.1

Name	Operator	Version
luci	eq	0.26.0__37.el6
luci	eq	0.26.0__37.el6_4.1
luci	eq	0.23.0__13.el6
luci	eq	0.26.0__48.el6
luci	eq	0.26.0__13.el6
luci	eq	0.22.2__14.el6_0.1
luci	eq	0.23.0__32.el6
luci	eq	0.22.2__14.el6
luci	eq	0.26.0__37.el6
luci	eq	0.26.0__37.el6_4.1