CVE-2023-38319: OS Command Injection
Published Jan 26, 2024
·Updated
An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.
Affected Software
1 affected component
OpenNDS openNDS<10.1.3
Event History
Jan 26, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-38319?
CVE-2023-38319 has a critical severity level due to the potential for remote command execution.
2
How do I fix CVE-2023-38319?
To fix CVE-2023-38319, update OpenNDS to version 10.1.3 or later.
3
What systems are affected by CVE-2023-38319?
CVE-2023-38319 affects OpenNDS versions prior to 10.1.3.
4
Can CVE-2023-38319 be exploited remotely?
Yes, CVE-2023-38319 can be exploited remotely if attackers can access the configuration file.
5
What type of vulnerability is CVE-2023-38319?
CVE-2023-38319 is a command injection vulnerability caused by improper sanitization of the FAS key in the configuration file.