CVE-2020-17505: OS Command Injection

Published Aug 12, 2020

Updated

Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via servicecmdspeform.

Affected Software

1 affected component

Articatech Web Proxy=4.30.000000

Event History

Aug 12, 2020

CVE Published

via MITRE·04:33 PM

Data Sourced

via MITRE·04:33 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-17505?

CVE-2020-17505 is classified as a critical vulnerability due to its ability to allow remote command injection with root privileges.

How do I fix CVE-2020-17505?

To mitigate CVE-2020-17505, it is recommended to upgrade the Artica Web Proxy to a patched version that addresses the command injection flaw.

Who is affected by CVE-2020-17505?

CVE-2020-17505 affects users of Artica Web Proxy version 4.30.000000, where an authenticated remote attacker can exploit the vulnerability.

What type of attack is associated with CVE-2020-17505?

CVE-2020-17505 enables authenticated remote attackers to perform command injection attacks through the service-cmds parameter.

What are the potential consequences of exploiting CVE-2020-17505?

Exploiting CVE-2020-17505 can lead to unauthorized access and control over the affected system due to execution of arbitrary commands with root privileges.