OS Command Injection

2019-11-2906:23:27

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0005 Low

EPSS

Percentile

17.9%

JSON

Ansible is vulnerable to OS command injection. The attack is possible because the module nxos_file_copy does not validate the remote_file parameter and directly uses the filenames from the parameter to copy files to a flash or bootflash on NXOS devices, allowing an attacker to inject malicious command through it.

CPENameOperatorVersion
ansiblele2.7.15
ansiblele2.8.7
ansiblele2.6.20
ansibleeq2.8.1__1.el7ae
ansibleeq2.8.5__1.el7
ansibleeq2.5.15__1.el7ae
ansibleeq2.2.0__0.50.prerelease.el7
ansibleeq2.7.2__1.el7
ansibleeq2.7.5__1.el7ae
ansibleeq2.6.10__1.el7ae

Name	Operator	Version
ansible	le	2.7.15
ansible	le	2.8.7
ansible	le	2.6.20
ansible	eq	2.8.1__1.el7ae
ansible	eq	2.8.5__1.el7
ansible	eq	2.5.15__1.el7ae
ansible	eq	2.2.0__0.50.prerelease.el7
ansible	eq	2.7.2__1.el7
ansible	eq	2.7.5__1.el7ae
ansible	eq	2.6.10__1.el7ae