SB2019020113 - Command Injection in Artica Proxy
Published: February 1, 2019 Updated: August 8, 2020
Security Bulletin ID
SB2019020113
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Command Injection (CVE-ID: CVE-2019-7300)
The vulnerability allows a remote privileged user to execute arbitrary code.
Artica Proxy 3.06.200056 allows remote attackers to execute arbitrary commands as root by reading the ressources/settings.inc ldap_admin and ldap_password fields, using these credentials at logon.php, and then entering the commands in the admin.index.php command-line field.
Remediation
Install update from vendor's website.