A command injection vulnerability in the sandcat plugin of Caldera 2.3.1 and earlier allows authenticated attackers to execute any command or service.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HMitre Caldera
APPMitre≤ 2.3.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
Related vulnerabilities
CVE-2021-42560HIGH8.8ten sam produkt
An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when gen...
CVE-2021-42562HIGH8.1ten sam produkt
An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-adm...
CVE-2021-42561HIGH8.8ten sam produkt
An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name paramet...
CVE-2021-42559HIGH8.8ten sam produkt
An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands wh...
CVE-2022-41139MEDIUM5.4ten sam produkt
MITRE CALDERA 4.1.0 allows stored XSS via app.contact.gist (aka the gist contact configuration field), leading...