Command injection

2020-02-2616:15:00

PRIOn knowledge base

www.prio-n.com

9.9 High

AI Score

Confidence

High

0.02 Low

EPSS

Percentile

88.8%

JSON

An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows blind Command Injection. An attacker without authentication is able to execute arbitrary operating system command by injecting the vulnerable parameter in the PHP Web page /common/vam_monitor_sap.php.

CPENameOperatorVersion
visual_access_managerge4.15.0
visual_access_managerle4.29.0

CPE	Name	Operator	Version
	visual_access_manager	ge	4.15.0
	visual_access_manager	le	4.29.0

References

www.seling.it/

www.seling.it/product/vam/

www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html