CRITICAL🇵🇱 Wersja polska

CVE-2020-24032

CVSS 9.8v3.1pub. 2020-08-18upd. 2024-11-21

tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell metacharacters in a timezone.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Xorux Lpar2rrd

    APP
    Xorux
    2.7.0

  • Xorux Stor2rrd

    APP
    Xorux
    2.7.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2021-42371CRITICAL9.8PL ✓same product

Hardkodowane konto systemowe w XoruX LPAR2RRD i STOR2RRD

CVE-2014-4981CRITICAL9.8PL ✓same product

Command Injection w LPAR2RRD — zdalne wykonanie poleceń systemowych

CVE-2014-4982CRITICAL9.8PL ✓same product

Command injection w Xorux LPAR2RRD — zdalne wykonanie poleceń

CVE-2025-54769HIGH8.8same product

An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file...

CVE-2021-42372HIGH8.8same product

A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows au...