Description

Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher

Remediation

References

http://www.openwall.com/lists/oss-security/2022/11/23/1

https://lists.apache.org/thread/2f126y32bf1v3mvxkdgt2jr5j3l1t01w

Related Vulnerabilities

CVE-2023-26513 Vulnerability in maven package org.apache.sling:org.apache.sling.resourcemerger

CVE-2020-2204 Vulnerability in maven package org.jenkins-ci.plugins:fortify-on-demand-uploader

CVE-2022-23945 Vulnerability in maven package org.apache.shenyu:shenyu-common

CVE-2023-37944 Vulnerability in maven package org.datadog.jenkins.plugins:datadog

CVE-2019-5457 Vulnerability in npm package min-http-server

Severity

Critical

Classification

CWE-77 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory