CVE-2018-1000666 - GIG Technology NV JumpScale Portal 7 version before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in method: notifySpaceModification; that can result in Improper validation of parameters results in command execution

Back Back to CVE browser

CRITICAL

GIG Technology NV JumpScale Portal 7 version before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in method: notifySpaceModification; that can result in Improper validation of parameters results in command execution

Published Sep 6, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 8.08%

Description

GIG Technology NV JumpScale Portal 7 version before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in method: notifySpaceModification; that can result in Improper validation of parameters results in command execution. This attack appear to be exploitable via Network connectivity, required minimal auth privileges (everyone can register an account). This vulnerability appears to have been fixed in After commit 15443122ed2b1cbfd7bdefc048bf106f075becdb.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (5)

https://github.com/0-complexity/openvcloud/issues/1207
x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://github.com/jumpscale7/jumpscale_portal/blob/c997bb1824862b08246d60e34e950df06ebac68c/apps/portalbase/system/system__contentmanager/methodclass/system_contentmanager.py#L293-L315
x_refsource_MISCExploitThird Party Advisory
https://github.com/jumpscale7/jumpscale_portal/pull/108
x_refsource_CONFIRMBroken Link
https://medium.com/%40vrico315/vulnerability-in-jumpscale-portal-7-a88098a1caca
x_refsource_MISC
https://telegra.ph/Description-of-vulnerability-in-JumpScale-Portal-7-08-23
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://github.com/0-complexity/openvcloud/issues/1207		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://github.com/jumpscale7/jumpscale_portal/blob/c997bb1824862b08246d60e34e950df06ebac68c/apps/portalbase/system/system__contentmanager/methodclass/system_contentmanager.py#L293-L315		x_refsource_MISCExploitThird Party Advisory
https://github.com/jumpscale7/jumpscale_portal/pull/108		x_refsource_CONFIRMBroken Link
https://medium.com/%40vrico315/vulnerability-in-jumpscale-portal-7-a88098a1caca		x_refsource_MISC
https://telegra.ph/Description-of-vulnerability-in-JumpScale-Portal-7-08-23		x_refsource_MISCExploitThird Party Advisory