Description

Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher

Remediation

References

http://www.openwall.com/lists/oss-security/2022/11/23/1

https://lists.apache.org/thread/2f126y32bf1v3mvxkdgt2jr5j3l1t01w

Related Vulnerabilities

CVE-2014-3577 Vulnerability in maven package org.apache.httpcomponents:httpclient

CVE-2020-2282 Vulnerability in maven package org.jenkins-ci.plugins:implied-labels

CVE-2019-10345 Vulnerability in maven package io.jenkins:configuration-as-code

CVE-2023-33725 Vulnerability in maven package org.broadleafcommerce:broadleaf

CVE-2023-29199 Vulnerability in npm package vm2

Severity

Critical

Classification

CWE-77 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory