CVE-2018-16146 Command injection in n/a
An authenticated administrator can execute arbitrary commands via the notification test feature in Opsview Monitor's web console.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-16146?
CVE-2018-16146 is a high-severity command injection vulnerability in n/a, published on 5 Sep 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test notifications that are triggered under certain configurable events. The value parameter is not properly sanitized, leading to arbitrary command injection with the privileges of the nagios user account.
Weakness: CWE-78
Which versions are affected by CVE-2018-16146?
It affects 1 product.
Products include Opsview Opsview.
How do I fix CVE-2018-16146?
No fix has been published for CVE-2018-16146 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-16146 being exploited?
There is no known exploitation of CVE-2018-16146 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-fh92-wm8w-xpmm.