CVE-2018-12307: Command Injection
Published Dec 4, 2018
·Updated
OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter.
Affected Software
2 affected components
ASUSTOR Data Master=3.1.1
ASUSTOR As602t
Event History
Dec 4, 2018
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for the OS command injection in ASUSTOR ADM?
The vulnerability ID for the OS command injection in ASUSTOR ADM is CVE-2018-12307.
2
What is the severity of CVE-2018-12307?
The severity of CVE-2018-12307 is critical with a severity value of 8.8.
3
Which version of ASUSTOR ADM is affected by CVE-2018-12307?
ASUSTOR ADM version 3.1.1 is affected by CVE-2018-12307.
4
How can attackers exploit CVE-2018-12307?
Attackers can exploit CVE-2018-12307 by executing system commands as root via the "name" POST parameter in user.cgi.
5
Are there any known fixes or mitigations for CVE-2018-12307?
There is no known fix or mitigation for CVE-2018-12307 at the moment. It is recommended to update to a non-vulnerable version when available.