CVE-2023-45354 Command injection in n/a

High 8.8 Published 9 Oct 2023 Updated 19 Sep 2024

Authenticated attackers can execute arbitrary OS commands via the web interface, requiring an upgrade to secure the management portal.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-45354?

CVE-2023-45354 is a high-severity command injection vulnerability in n/a, published on 9 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated remote attacker to execute arbitrary code on the operating system by using the Common Management Portal web interface. This is also known as OCMP-6589.

Which versions are affected by CVE-2023-45354?

It affects 1 product.

Products include Atos Unify Openscape Common Management.

How do I fix CVE-2023-45354?

No fix has been published for CVE-2023-45354 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-45354 being exploited?

There is no known exploitation of CVE-2023-45354 in the wild and no public exploit code.

Sources

Also known as GHSA-3633-c8j4-9489.