Command Injection

2022-08-2512:54:27

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

teleport

command injection

social engineering

malicious code

software vulnerability

EPSS

0.031

Percentile

91.2%

JSON

github.com/gravitational/teleport is vulnerable to command injection. An unauthenticated attacker is able to craft a malicious ssh agent installation link hosted on the teleport server to use in a social engineering attack, which then can be used to execute malicious code in the background.