CVE-2020-10879: OS Command Injection
Published Mar 23, 2020
·Updated
rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped.
Affected Software
1 affected component
rConfig rConfig<3.9.5
Remediation
Event History
Mar 23, 2020
CVE Published
via MITRE·09:44 PM
Data Sourced
via MITRE·09:44 PM
Description
Frequently Asked Questions
1
What is CVE-2020-10879?
CVE-2020-10879 is a vulnerability in rConfig before version 3.9.5 that allows command injection through a crafted GET request.
2
What is the severity of CVE-2020-10879?
The severity of CVE-2020-10879 is critical with a CVSS score of 9.8.
3
How does CVE-2020-10879 affect rConfig?
CVE-2020-10879 affects rConfig versions up to and excluding 3.9.5.
4
How can CVE-2020-10879 be exploited?
CVE-2020-10879 can be exploited by sending a crafted GET request to the lib/crud/search.crud.php endpoint with a malicious nodeId parameter.
5
How can I fix CVE-2020-10879?
To fix CVE-2020-10879, upgrade to rConfig version 3.9.5 or later.