CVE Vulnerability

CVE-2018-14417

A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv script did not sanitize the 'recentVersion' parameter from the snserv endpoint, allowing an unauthenticated attacker to execute arbitrary commands with root permissions.

10 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.coresecurity.com/advisories/softnas-cloud-os-command-injection Exploit Third Party Advisory
https://docs.softnas.com/display/SD/Release+Notes Vendor Advisory
http://seclists.org/fulldisclosure/2018/Jul/85 Exploit Mailing List
https://www.exploit-db.com/exploits/45097/ Exploit Third Party Advisory
http://www.securityfocus.com/bid/104914 VDB Entry Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:softnas:cloud:*:*:*:*:*:*:*:*
Information

Published : 2018-08-04 01:29

Updated : 2018-10-02 08:24

NVD link : CVE-2018-14417

Mitre link : CVE-2018-14417

Products Affected
No products.
CWE
CWE-78