CVE-2020-10879

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped.

Affected products

Rconfig

Rconfig

< 3.9.5

Fix

Available

CVSS 3.1

9.8 CRITICAL

EPSS

83.9% (100th percentile)

Weakness

CWE-78

NVD status

Modified

Published

2020-03-23