CVE-2021-41744 Command injection in n/a
An attacker can exploit a command injection vulnerability in Yonyou PLM to gain unauthorized server permissions and execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-41744?
CVE-2021-41744 is a critical command injection vulnerability in n/a, published on 22 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of yongyou PLM are affected by a command injection issue. UFIDA PLM (Product Life Cycle Management) is a strategic management method. It applies a series of enterprise application systems to support the entire process from conceptual design to the end of product life, and the collaborative creation, distribution, application and management of product information across organizations. Yonyou PLM uses jboss by default, and you can access the management control background without authorization An attacker can use this vulnerability to gain server permissions.
Weakness: CWE-77
Which versions are affected by CVE-2021-41744?
It affects 1 product.
Products include Yonyou Ufida Product Lifecycle Management.
How do I fix CVE-2021-41744?
No fix has been published for CVE-2021-41744 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-41744 being exploited?
There is no known exploitation of CVE-2021-41744 in the wild and no public exploit code.
Sources
Also known as GHSA-fg8j-7f6f-qg52.