CVE-2021-42561
PoC —CVSS 3.1
8.8 high
EPSS
20%p97
Published
()
Modified
Description
An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allows attackers to use shell metacharacters (e.g., backticks "``" or dollar parenthesis "$()" ) in order to escape the current command and execute arbitrary shell commands.
- Vendors
- mitre
- Products
- caldera
- Weakness
- CWE-74
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.