CVE-2018-1000666 Command injection in n/a
An attacker with minimal privileges can execute arbitrary OS commands via improper parameter validation in the JumpScale Portal notification method.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-1000666?
CVE-2018-1000666 is a critical command injection vulnerability in n/a, published on 6 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GIG Technology NV JumpScale Portal 7 version before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in method: notifySpaceModification; that can result in Improper validation of parameters results in command execution. This attack appear to be exploitable via Network connectivity, required minimal auth privileges (everyone can register an account). This vulnerability appears to have been fixed in After commit 15443122ed2b1cbfd7bdefc048bf106f075becdb.
Weakness: CWE-78
Which versions are affected by CVE-2018-1000666?
It affects 2 products.
Products include Gig Jumpscale, Openvcloud Project Openvcloud.
How do I fix CVE-2018-1000666?
No fix has been published for CVE-2018-1000666 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-1000666 being exploited?
There is no known exploitation of CVE-2018-1000666 in the wild and no public exploit code.
Sources
Also known as GHSA-vf7g-gwvv-qxxr.