CVE-2022-51019: falha de alta gravidade em akaunting
Akaunting before 2.1.31 OS Command Injection via app alias
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 1.8%
probabilidade de exploração
1.8%top 22% das CVEs
exploração observada
nãonenhuma fonte reporta
Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to execute arbitrary commands on the server.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
akaunting · akauntingCVEs relacionadas — akaunting
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/akaunting/akauntinghttps://github.com/akaunting/akaunting/blob/2.1.30/app/Jobs/Install/FinishUpdate.php#L45-L47https://github.com/akaunting/akaunting/blob/2.1.30/app/Jobs/Install/InstallModule.php#L37-L39https://github.com/akaunting/akaunting/commit/a1792327347a56ea575240b58673b2ece44230dahttps://github.com/akaunting/akaunting/releases/tag/2.1.31https://www.vulncheck.com/advisories/akaunting-before-2.1.31-os-command-injection-via-app-alias