CVE-2020-25494: OS Command Injection
Published Dec 18, 2020
·Updated
Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-bin/printbook.
Affected Software
2 affected components
Xinuos Openserver=5.0.7
Xinuos Openserver=6.0
Event History
Dec 18, 2020
CVE Published
via MITRE·02:27 PM
Data Sourced
via MITRE·02:27 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-25494?
CVE-2020-25494 is considered a critical vulnerability due to its potential for remote command execution.
2
How do I fix CVE-2020-25494?
To fix CVE-2020-25494, update Xinuos OpenServer to the latest version where the vulnerability has been patched.
3
Who is affected by CVE-2020-25494?
CVE-2020-25494 affects users of Xinuos OpenServer versions 5.0.7 and 6.0.
4
What type of vulnerability is CVE-2020-25494?
CVE-2020-25494 is a command injection vulnerability allowing attackers to execute arbitrary commands.
5
How can attackers exploit CVE-2020-25494?
Attackers can exploit CVE-2020-25494 by injecting shell metacharacters in the outputform or toclevels parameters of the cgi-bin/printbook.