Description

Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher

Remediation

References

https://lists.apache.org/thread/2f126y32bf1v3mvxkdgt2jr5j3l1t01w

http://www.openwall.com/lists/oss-security/2022/11/23/1

Related Vulnerabilities

CVE-2021-46708 Vulnerability in maven package org.webjars.bower:swagger-ui

CVE-2017-7525 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2022-43408 Vulnerability in maven package org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-view

CVE-2021-32684 Vulnerability in npm package magento-scripts

CVE-2023-22665 Vulnerability in maven package org.apache.jena:jena-arq

Severity

Critical

Classification

CWE-77 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Vendor Advisory Third Party Advisory