Command Injection

2022-12-2908:15:50

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

rdiffweb vulnerability

command injection

notification.py

character sanitisation

ssh key names

malicious website.

EPSS

0.001

Percentile

30.3%

JSON

rdiffweb is vulnerable to command injection. The vulnerability exists in notification.py due to lack of character sanitisation in SSH key names which allows an attacker to inject a hyperlink that allows an attacker to redirect victim to malicious website.