GHSA-hhqm-f4m4-pq39

Source

https://github.com/advisories/GHSA-hhqm-f4m4-pq39

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-hhqm-f4m4-pq39/GHSA-hhqm-f4m4-pq39.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hhqm-f4m4-pq39

Aliases

CVE-2023-30260

Published

2023-06-23T12:30:18Z

Modified

2024-02-16T08:20:34Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

RaspAP raspap-webgui Command Injection vulnerability

Details

Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.

Database specific

{
    "cwe_ids":  [
        "CWE-77"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-06-23T21:44:57Z",
    "nvd_published_at":  "2023-06-23T12:15:09Z",
    "severity":  "HIGH"
}

References

Affected packages

Packagist / billz/raspap-webgui

Package

Name: billz/raspap-webgui
Purl: pkg:composer/billz/raspap-webgui

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.8.9

Affected versions

1.*

1.0

2.*

2.4.1

2.5

2.5.1

2.5.2

2.6-beta

2.6

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.6.6

2.6.7

2.6.8

2.6.9

2.7.0

2.7.1

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

2.8.5

2.8.6

2.8.7

2.8.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-hhqm-f4m4-pq39/GHSA-hhqm-f4m4-pq39.json"