Description

Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher

Remediation

References

https://lists.apache.org/thread/2f126y32bf1v3mvxkdgt2jr5j3l1t01w

http://www.openwall.com/lists/oss-security/2022/11/23/1

Related Vulnerabilities

CVE-2021-39232 Vulnerability in maven package org.apache.ozone:ozone-main

CVE-2020-2138 Vulnerability in maven package org.jenkins-ci.plugins:cobertura

CVE-2023-24433 Vulnerability in maven package io.jenkins.plugins:macstadium-orka

CVE-2022-31160 Vulnerability in maven package org.webjars:jquery-ui

CVE-2023-48238 Vulnerability in npm package json-web-token

Severity

Critical

Classification

CWE-77 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Vendor Advisory Third Party Advisory