CVE-2020-23151: OS Command Injection
Published Aug 9, 2021
·Updated
rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed directly to the exec function without being escaped.
Affected Software
1 affected component
rConfig rConfig=3.9.5
Event History
Aug 9, 2021
CVE Published
via MITRE·10:54 PM
Data Sourced
via MITRE·10:54 PM
Description
Frequently Asked Questions
1
What is CVE-2020-23151?
CVE-2020-23151 is a vulnerability in rConfig 3.9.5 that allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php.
2
How severe is CVE-2020-23151?
CVE-2020-23151 has a severity keyword of 'critical' and a severity value of 9.8.
3
How does CVE-2020-23151 affect rConfig?
CVE-2020-23151 affects rConfig version 3.9.5.
4
What is the CWE ID of CVE-2020-23151?
CVE-2020-23151 has CWE IDs 77 and 78.
5
How can I fix CVE-2020-23151?
To fix CVE-2020-23151, update rConfig to a version that is not affected by the vulnerability.