ByteOS Network

NVD Vulnerability Details :

CVE-2017-14535

Analyzed

Source-cve@mitre.org

Published At-16 Feb, 2018 | 04:29

Updated At-19 Feb, 2022 | 04:29

trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	9.0	HIGH	AV:N/AC:L/Au:S/C:C/I:C/A:C

CWE ID	Type	Source
CWE-78	Primary	nvd@nist.gov

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/162854/Trixbox-2.8.0.4-Remote-Code-Execution.html	cve@mitre.org	Exploit Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/103004	cve@mitre.org	Third Party Advisory VDB Entry
https://github.com/Hacker5preme/Exploits/tree/main/CVE-2017-14535-Exploit	cve@mitre.org	Exploit Third Party Advisory
https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/	cve@mitre.org	Exploit Third Party Advisory
https://twitter.com/tiger_tigerboy/status/962689803270500352	cve@mitre.org	Third Party Advisory
https://www.linkedin.com/pulse/trixbox-os-command-injection-vulnerability-sachin-wagh-ceh-ecsa-/?published=t	cve@mitre.org	Exploit Third Party Advisory