CVE-2020-12078: OS Command Injection
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called excludeip). This excludeip value is passed to the exec function in the discoverieshelper.php file (inside the alliplist function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-12078?
The severity of CVE-2020-12078 is critical with a CVSS score of 8.8.
How can an attacker exploit CVE-2020-12078?
An attacker can exploit CVE-2020-12078 by adding an excluded IP address to the global discovery settings.
How can I fix CVE-2020-12078?
To fix CVE-2020-12078, update Open-AudIT to version 3.3.2 or later.
What is the Common Weakness Enumeration (CWE) ID for CVE-2020-12078?
The CWE ID for CVE-2020-12078 is CWE-78.
Where can I find more information about CVE-2020-12078?
You can find more information about CVE-2020-12078 at the following references: [link1], [link2], [link3].