CVE Vulnerability

CVE-2018-1000666

GIG Technology NV JumpScale Portal 7 version before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in method: notifySpaceModification; that can result in Improper validation of parameters results in command execution. This attack appear to be exploitable via Network connectivity, required minimal auth privileges (everyone can register an account). This vulnerability appears to have been fixed in After commit 15443122ed2b1cbfd7bdefc048bf106f075becdb.

10 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://telegra.ph/Description-of-vulnerability-in-JumpScale-Portal-7-08-23 Exploit Third Party Advisory
https://github.com/jumpscale7/jumpscale_portal/pull/108 Broken Link
https://github.com/jumpscale7/jumpscale_portal/blob/c997bb1824862b08246d60e34e950df06ebac68c/apps/portalbase/system/system__contentmanager/methodclass/system_contentmanager.py#L293-L315 Exploit Third Party Advisory
https://github.com/0-complexity/openvcloud/issues/1207 Exploit Issue Tracking
https://medium.com/@vrico315/vulnerability-in-jumpscale-portal-7-a88098a1caca Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:openvcloud_project:openvcloud:*:*:*:*:*:*:*:*
cpe:2.3:a:gig:jumpscale:7:*:*:*:*:*:*:*
Information

Published : 2018-09-06 05:29

Updated : 2019-03-07 03:36

NVD link : CVE-2018-1000666

Mitre link : CVE-2018-1000666

Products Affected
No products.
CWE
CWE-78