CVE-2024-28114

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-28114
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28114.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-28114
Aliases
  • GHSA-q37x-qfrx-jcv6
Published
2024-03-12T19:58:39.859Z
Modified
2026-03-14T12:28:30.944383Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Remote Code Execution using Server Side Template Injection in Peering Manager
Details

Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manager <=1.8.2. As a result arbitrary commands can be executed on the operating system that is running Peering Manager. This issue has been addressed in version 1.8.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cwe_ids": [
        "CWE-74"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28114.json"
}
References

Affected packages

Git / github.com/peering-manager/peering-manager

Affected ranges

Type
GIT
Repo
https://github.com/peering-manager/peering-manager
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
08d822f3d11bc224a58385044d955163030865a4

Affected versions

v1.*
v1.0.0
v1.1.0
v1.2.0
v1.2.1
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v1.8.0
v1.8.1
v1.8.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28114.json"