Lucene search

Veracode Vulnerability DatabaseVERACODE:46113

HistoryApr 01, 2024 - 6:53 a.m.

Remote Code Execution (RCE)

2024-04-0106:53:02

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

aliyundrive_webdav

remote code execution

input validation

sanitization

action_query_qrcode

arbitrary code

vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

17.1%

JSON

aliyundrive_webdav is vulnerable to Remote Code Execution (RCE). The vulnerability is due to insufficient input validation and sanitization of the sid parameter of the action_query_qrcode component, which allows attackers to execute arbitrary code.

References

aliyundrive-webdav.com

aliyundrive-webdav.com/

github.com/advisories/GHSA-73v2-rxqp-7q4f

github.com/lakemoon602/vuln/blob/main/detail.md

github.com/messense/aliyundrive-webdav

github.com/messense/aliyundrive-webdav/openwrt/luci-app-aliyundrive-webdav/luasrc/controller/aliyundrive-webdav.lua

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

17.1%

JSON

Related for VERACODE:46113