CVE-2020-10221: rConfig OS Command Injection Vulnerability
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.
Other sources
rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this rConfig vulnerability?
The vulnerability ID for this rConfig vulnerability is CVE-2020-10221.
What is the title of this vulnerability?
The title of this vulnerability is rConfig OS Command Injection Vulnerability.
What is the description of this vulnerability?
The rConfig lib/ajaxHandlers/ajaxAddTemplate.php file contains an OS command injection vulnerability that allows remote attackers to execute OS commands by exploiting shell metacharacters in the fileName POST parameter.
Which software is affected by this vulnerability?
The rConfig software, specifically versions up to and including 3.9.4, is affected by this vulnerability.
What is the severity of this vulnerability?
The severity of this vulnerability is critical with a CVSS score of 8.8.