CoreCVE
Back

HIGH

In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems (where rh_shell_fix was enabled), and consequently allowed site admins to inject arbitrary OS commands

Published Feb 12, 2018

Description

In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems (where rh_shell_fix was enabled), and consequently allowed site admins to inject arbitrary OS commands. The impact is limited by the setting being only accessible to the site administrator.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-78

OS Command Injection

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Feb 12, 2018
Updated Sep 16, 2024
Reserved Feb 12, 2018
Link CVE-2018-6926
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 22, 2026
Link CVE-2018-6926
Red Hat
Severity n/a
Public date n/a
Links CVE-2018-6926