netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-p3mv-3xmv-c627
GHSA-2xh5-h62m-35rc
GHSA-384c-8455-8xjm
GHSA-3wjm-qx5r-4845
GHSA-4fwm-vfjv-mj7j
GHSA-5mpc-fr5x-rq6g
GHSA-74jh-9vmj-8f72
GHSA-c2jf-mjc7-c377
GHSA-c2pc-g3hh-8rhm
GHSA-cw57-3gg4-75xr
GHSA-g2cq-r84h-65g2
GHSA-m2xm-r93v-mjrm
GHSA-pp78-fggv-r899
GHSA-rqwm-368v-fp53
GHSA-x299-q796-x4w4
This commit is contained in:
advisory-database[bot]
2024-04-24 21:33:16 +00:00
parent e6657012c1
commit 2e280266de
15 changed files with 594 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/04/GHSA-p3mv-3xmv-c627/GHSA-p3mv-3xmv-c627.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p3mv-3xmv-c627",
"modified": "2024-04-04T03:28:03Z",
"modified": "2024-04-24T21:31:55Z",
"published": "2023-04-14T12:30:23Z",
"aliases": [
"CVE-2023-26756"
@@ -32,6 +32,10 @@
{
"type": "WEB",
"url": "http://revive.com"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Apr/27"
}
],
"database_specific": {
advisories/unreviewed/2024/04/GHSA-2xh5-h62m-35rc/GHSA-2xh5-h62m-35rc.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2xh5-h62m-35rc",
"modified": "2024-04-24T21:31:55Z",
"published": "2024-04-24T21:31:55Z",
"aliases": [
"CVE-2024-4123"
],
"details": "A vulnerability, which was classified as critical, has been found in Tenda W15E 15.11.0.14. Affected by this issue is the function formSetPortMapping of the file /goform/SetPortMapping. The manipulation of the argument portMappingServer/portMappingProtocol/portMappingWan/porMappingtInternal/portMappingExternal leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-261866 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4123"
},
{
"type": "WEB",
"url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W15Ev1.0/formSetPortMapping.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.261866"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.261866"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.317828"
}
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T19:15:47Z"
}
}
advisories/unreviewed/2024/04/GHSA-384c-8455-8xjm/GHSA-384c-8455-8xjm.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-384c-8455-8xjm",
"modified": "2024-04-24T21:31:56Z",
"published": "2024-04-24T21:31:56Z",
"aliases": [
"CVE-2024-20295"
],
"details": "A vulnerability in the CLI of the Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have read-only or higher privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could allow the attacker to elevate privileges to root.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20295"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-mUx4c5AJ"
}
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T20:15:07Z"
}
}
advisories/unreviewed/2024/04/GHSA-3wjm-qx5r-4845/GHSA-3wjm-qx5r-4845.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3wjm-qx5r-4845",
"modified": "2024-04-24T21:31:55Z",
"published": "2024-04-24T21:31:55Z",
"aliases": [
"CVE-2024-4141"
],
"details": "Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid character code in a Type 1 font. The root problem was a bounds check that was being optimized away by modern compilers.\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4141"
},
{
"type": "WEB",
"url": "https://www.xpdfreader.com/security-bug/CVE-2024-4141.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T19:15:47Z"
}
}
advisories/unreviewed/2024/04/GHSA-4fwm-vfjv-mj7j/GHSA-4fwm-vfjv-mj7j.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4fwm-vfjv-mj7j",
"modified": "2024-04-24T21:31:58Z",
"published": "2024-04-24T21:31:58Z",
"aliases": [
"CVE-2023-20248"
],
"details": "A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by inserting malicious data in a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20248"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tms-portal-xss-AXNeVg3s"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T21:15:46Z"
}
}
advisories/unreviewed/2024/04/GHSA-5mpc-fr5x-rq6g/GHSA-5mpc-fr5x-rq6g.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5mpc-fr5x-rq6g",
"modified": "2024-04-24T21:31:56Z",
"published": "2024-04-24T21:31:55Z",
"aliases": [
"CVE-2024-4124"
],
"details": "A vulnerability, which was classified as critical, was found in Tenda W15E 15.11.0.14. This affects the function formSetRemoteWebManage of the file /goform/SetRemoteWebManage. The manipulation of the argument remoteIP leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261867. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4124"
},
{
"type": "WEB",
"url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W15Ev1.0/formSetRemoteWebManage.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.261867"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.261867"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.317829"
}
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T19:15:47Z"
}
}
advisories/unreviewed/2024/04/GHSA-74jh-9vmj-8f72/GHSA-74jh-9vmj-8f72.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-74jh-9vmj-8f72",
"modified": "2024-04-24T21:31:58Z",
"published": "2024-04-24T21:31:58Z",
"aliases": [
"CVE-2024-20313"
],
"details": "A vulnerability in the OSPF version 2 (OSPFv2) feature of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of OSPF updates that are processed by a device. An attacker could exploit this vulnerability by sending a malformed OSPF update to the device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20313"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-ospf-dos-dR9Sfrxp"
}
],
"database_specific": {
"cwe_ids": [
"CWE-120"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T21:15:46Z"
}
}
advisories/unreviewed/2024/04/GHSA-c2jf-mjc7-c377/GHSA-c2jf-mjc7-c377.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c2jf-mjc7-c377",
"modified": "2024-04-24T21:31:55Z",
"published": "2024-04-24T21:31:55Z",
"aliases": [
"CVE-2024-4125"
],
"details": "A vulnerability has been found in Tenda W15E 15.11.0.14 and classified as critical. This vulnerability affects the function formSetStaticRoute of the file /goform/setStaticRoute. The manipulation of the argument staticRouteIndex leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261868. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4125"
},
{
"type": "WEB",
"url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W15Ev1.0/formSetStaticRoute.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.261868"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.261868"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.317830"
}
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T19:15:47Z"
}
}
advisories/unreviewed/2024/04/GHSA-c2pc-g3hh-8rhm/GHSA-c2pc-g3hh-8rhm.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c2pc-g3hh-8rhm",
"modified": "2024-04-24T21:31:58Z",
"published": "2024-04-24T21:31:58Z",
"aliases": [
"CVE-2023-20249"
],
"details": "A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by inserting malicious data in a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20249"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tms-portal-xss-AXNeVg3s"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T21:15:46Z"
}
}
advisories/unreviewed/2024/04/GHSA-cw57-3gg4-75xr/GHSA-cw57-3gg4-75xr.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cw57-3gg4-75xr",
"modified": "2024-04-24T21:31:56Z",
"published": "2024-04-24T21:31:56Z",
"aliases": [
"CVE-2024-4127"
],
"details": "A vulnerability was found in Tenda W15E 15.11.0.14. It has been classified as critical. Affected is the function guestWifiRuleRefresh. The manipulation of the argument qosGuestDownstream leads to stack-based buffer overflow. It is possible to launch the attack remotely. VDB-261870 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4127"
},
{
"type": "WEB",
"url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W15Ev1.0/guestWifiRuleRefresh.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.261870"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.261870"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.317832"
}
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T20:15:08Z"
}
}
advisories/unreviewed/2024/04/GHSA-g2cq-r84h-65g2/GHSA-g2cq-r84h-65g2.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g2cq-r84h-65g2",
"modified": "2024-04-24T21:31:56Z",
"published": "2024-04-24T21:31:56Z",
"aliases": [
"CVE-2024-4126"
],
"details": "A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical. This issue affects the function formSetSysTime of the file /goform/SetSysTimeCfg. The manipulation of the argument manualTime leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261869 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4126"
},
{
"type": "WEB",
"url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W15Ev1.0/formSetSysTime.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.261869"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.261869"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.317831"
}
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T20:15:08Z"
}
}
advisories/unreviewed/2024/04/GHSA-m2xm-r93v-mjrm/GHSA-m2xm-r93v-mjrm.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m2xm-r93v-mjrm",
"modified": "2024-04-24T21:31:56Z",
"published": "2024-04-24T21:31:56Z",
"aliases": [
"CVE-2024-20356"
],
"details": "A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with Administrator-level privileges to perform command injection attacks on an affected system and elevate their privileges to root. This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to elevate their privileges to root.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20356"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-bLuPcb"
}
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T20:15:07Z"
}
}
advisories/unreviewed/2024/04/GHSA-pp78-fggv-r899/GHSA-pp78-fggv-r899.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pp78-fggv-r899",
"modified": "2024-04-24T21:31:55Z",
"published": "2024-04-24T21:31:55Z",
"aliases": [
"CVE-2024-20353"
],
"details": "A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.\n\n This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20353"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-websrvs-dos-X8gNucD2"
}
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T19:15:46Z"
}
}
advisories/unreviewed/2024/04/GHSA-rqwm-368v-fp53/GHSA-rqwm-368v-fp53.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rqwm-368v-fp53",
"modified": "2024-04-24T21:31:55Z",
"published": "2024-04-24T21:31:55Z",
"aliases": [
"CVE-2024-20359"
],
"details": "A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability.\n\n This vulnerability is due to improper validation of a file when it is read from system flash memory. An attacker could exploit this vulnerability by copying a crafted file to the disk0: file system of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior. Because the injected code could persist across device reboots, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20359"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T19:15:46Z"
}
}
advisories/unreviewed/2024/04/GHSA-x299-q796-x4w4/GHSA-x299-q796-x4w4.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x299-q796-x4w4",
"modified": "2024-04-24T21:31:56Z",
"published": "2024-04-24T21:31:56Z",
"aliases": [
"CVE-2024-20358"
],
"details": "A vulnerability in the Cisco Adaptive Security Appliance (ASA) restore functionality that is available in Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This vulnerability exists because the contents of a backup file are improperly sanitized at restore time. An attacker could exploit this vulnerability by restoring a crafted backup file to an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system as root.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20358"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-cmd-inj-ZJV8Wysm"
}
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T20:15:07Z"
}
}