CVE-2020-13167: OS Command Injection
Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-13167?
CVE-2020-13167 is a vulnerability in Netsweeper through 6.4.3 that allows unauthenticated remote code execution.
How severe is CVE-2020-13167?
CVE-2020-13167 is considered critical with a severity score of 9.8.
What is the affected software for CVE-2020-13167?
The affected software is Netsweeper version 6.4.3.
How can the vulnerability be exploited?
The vulnerability can be exploited by sending certain Referer headers to the webadmin/tools/unixlogin.php page, which allows injection of shell metacharacters and subsequent execution of remote code.
Are there any fixes or patches available for CVE-2020-13167?
It is recommended to update Netsweeper to a version beyond 6.4.3 to mitigate the vulnerability.