SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory with .dns.pid extension. Unauthenticated attackers can execute the malicious commands by making a single HTTP POST request to the vulnerable dns.php script, which triggers command execution and then deletes the file.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50789.json"
[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.15"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.69"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.15"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.69"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.15"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.69"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.16"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.16"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.2"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.30"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.11"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.4.29"
}
]
}
]