CVE-2024-26260

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26260
The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96 Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.html Third Party Advisory
https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96 Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:hgiga:oaklouds-organization-2.0:*:*:*:*:*:*:*:*
cpe:2.3:a:hgiga:oaklouds-organization-3.0:*:*:*:*:*:*:*:*
cpe:2.3:a:hgiga:oaklouds-webbase-2.0:*:*:*:*:*:*:*:*
cpe:2.3:a:hgiga:oaklouds-webbase-3.0:*:*:*:*:*:*:*:*
History

23 Jan 2025, 19:55

Type Values Removed Values Added
References () https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96 - () https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96 - Third Party Advisory
References () https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.html - () https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.html - Third Party Advisory
First Time Hgiga
Hgiga oaklouds-organization-3.0
Hgiga oaklouds-organization-2.0
Hgiga oaklouds-webbase-3.0
Hgiga oaklouds-webbase-2.0
CPE cpe:2.3:a:hgiga:oaklouds-webbase-2.0:*:*:*:*:*:*:*:*
cpe:2.3:a:hgiga:oaklouds-organization-3.0:*:*:*:*:*:*:*:*
cpe:2.3:a:hgiga:oaklouds-organization-2.0:*:*:*:*:*:*:*:*
cpe:2.3:a:hgiga:oaklouds-webbase-3.0:*:*:*:*:*:*:*:*

21 Nov 2024, 09:02

Type Values Removed Values Added
References () https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96 - () https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96 -
References () https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.html - () https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.html -

28 Jun 2024, 02:15

Type Values Removed Values Added
References
  • () https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96 -
Summary
  • (es) La funcionalidad de sincronización en ciertos módulos de HGiga OAKlouds tiene una vulnerabilidad de inyección de comandos del sistema operativo, lo que permite a atacantes remotos inyectar comandos del sistema dentro de parámetros de solicitud específicos. Esto permite la ejecución de código arbitrario en el servidor remoto sin permiso.

15 Feb 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-15 03:15

Updated : 2025-01-23 19:55

NVD link : CVE-2024-26260

Mitre link : CVE-2024-26260

CVE.ORG link : CVE-2024-26260

JSON object : View

Products Affected

hgiga

  • oaklouds-organization-3.0
  • oaklouds-organization-2.0
  • oaklouds-webbase-3.0
  • oaklouds-webbase-2.0
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')