CVE-2020-8429 Command injection in n/a
An authenticated attacker can execute arbitrary OS commands via the getLogs function due to insufficient input sanitization in the Kinetica Admin web application.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8429?
CVE-2020-8429 is a high-severity command injection vulnerability in n/a, published on 11 Feb 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Admin web application in Kinetica 7.0.9.2.20191118151947 does not properly sanitise the input for the function getLogs. This lack of sanitisation could be exploited to allow an authenticated attacker to run remote code on the underlying operating system. The logFile parameter in the getLogs function was used as a variable in a command to read log files; however, due to poor input sanitisation, it was possible to bypass a replacement and break out of the command.
Weakness: CWE-78
Which versions are affected by CVE-2020-8429?
It affects 1 product.
Products include Kinetica Kinetica.
How do I fix CVE-2020-8429?
No fix has been published for CVE-2020-8429 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-8429 being exploited?
There is no known exploitation of CVE-2020-8429 in the wild and no public exploit code.
Sources
Also known as GHSA-w88r-jmxq-9fpj.