CVE-2022-31794: OS Command Injection
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the requestTempFile function in hwview.php. An attacker is able to influence the unitName POST parameter and inject special characters such as semicolons, backticks, or command-substitution sequences in order to force the application to execute arbitrary commands.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-31794?
The severity of CVE-2022-31794 is critical with a score of 9.8.
How does the vulnerability in CVE-2022-31794 affect Fujitsu ETERNUS CentricStor CS8000 devices?
The vulnerability in CVE-2022-31794 allows an attacker to inject special characters and execute commands on Fujitsu ETERNUS CentricStor CS8000 devices.
What is the affected software version in CVE-2022-31794?
The affected software version in CVE-2022-31794 is Fujitsu ETERNUS CentricStor CS8000 firmware version 8.1.
Is Fujitsu ETERNUS CS8000 vulnerable to CVE-2022-31794?
No, Fujitsu ETERNUS CS8000 is not vulnerable to CVE-2022-31794.
How can the vulnerability in CVE-2022-31794 be mitigated?
To mitigate the vulnerability in CVE-2022-31794, it is recommended to upgrade to Fujitsu ETERNUS CentricStor CS8000 firmware version 8.1A SP02 P04 or later.