CVE-2020-13124 Command injection in n/a

What is CVE-2020-13124?

CVE-2020-13124 is a high-severity command injection vulnerability in n/a, published on 11 Aug 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to execute arbitrary Python commands on the underlying operating system.

Weakness: CWE-78

Which versions are affected by CVE-2020-13124?

It affects 1 product.

Products include Sabnzbd Sabnzbd.

How do I fix CVE-2020-13124?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-13124 being exploited?

There is no known exploitation of CVE-2020-13124 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-34237 Remote code execution via specially crafted script settings in SABnzbd High 8.1
• CVE-2021-29488 Creation of files outside the Download Folder through malicious PAR2 files Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2020-13124, GHSA-9x87-96gg-33w2, UBUNTU-CVE-2020-13124.