The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious organisationname.
References
Link | Resource |
---|---|
https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories | Exploit Third Party Advisory |
Configurations
History
29 Aug 2024, 15:24
Type | Values Removed | Values Added |
---|---|---|
References | () https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories - Exploit, Third Party Advisory | |
Summary |
|
|
CPE | cpe:2.3:a:fiware:keyrock:*:*:*:*:*:*:*:* | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
First Time |
Fiware
Fiware keyrock |
12 Aug 2024, 13:41
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-08-12 13:38
Updated : 2024-08-29 15:24
NVD link : CVE-2024-42167
Mitre link : CVE-2024-42167
CVE.ORG link : CVE-2024-42167
JSON object : View
Products Affected
fiware
- keyrock
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')