CVE-2020-12078: opmantek open-audit

Vulnerability summary

CVE-2020-12078 is a high (CVSS 9.0) vulnerability in opmantek open-audit. EPSS estimates a 10.00% chance of exploitation in the next 30 days, higher than 95.6% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 28-04-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address.

• CWE-78Improper Neutralization of Special Elements used in an OS CommandThe product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.