CVE-2015-7774: OS Command Injection
Published Nov 14, 2015
·Updated
PC-EGG pWebManager before 3.3.10, and before 2.2.2 for PHP 4.x, allows remote authenticated users to execute arbitrary OS commands by leveraging the editor role.
Affected Software
12 affected components
PC-EGG pWebManager<=3.3.9a
PC-EGG pWebManager<=2.2.2
PHP PHP=4.4.0
PHP PHP=4.4.1
PHP PHP=4.4.2
PHP PHP=4.4.3
PHP PHP=4.4.4
PHP PHP=4.4.5
PHP PHP=4.4.6
PHP PHP=4.4.7
PHP PHP=4.4.8
PHP PHP=4.4.9
Remediation
Patch Available
Event History
Nov 14, 2015
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-7774?
CVE-2015-7774 is considered a high severity vulnerability due to its potential for remote command execution by authenticated users.
2
How do I fix CVE-2015-7774?
To fix CVE-2015-7774, upgrade to PC-EGG pWebManager version 3.3.10 or higher, or version 2.2.3 for PHP 4.x.
3
Who is affected by CVE-2015-7774?
CVE-2015-7774 affects users of PC-EGG pWebManager versions prior to 3.3.10 and 2.2.2 for PHP 4.x.
4
What kind of attacks can CVE-2015-7774 facilitate?
CVE-2015-7774 can facilitate attacks that allow remote authenticated users to execute arbitrary operating system commands.
5
Are any specific configurations needed to exploit CVE-2015-7774?
Exploitation of CVE-2015-7774 requires an authenticated user with an editor role within the affected PC-EGG pWebManager system.