GitHub Advisoryadvisory · Packagist

GHSA-7vph-p634-vrqf Command Injection in RaspAP 2.6.6

HIGH Published 2021-09-02 Modified 2021-09-03 Official page ↗

Aliases: CVE-2021-38556
Ecosystem: Packagist
Packages: billz/raspap-webgui
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-77
Reviewed: 2021-08-25

Affected packages

• Packagist billz/raspap-webgui: <= 2.6.6 (no fix yet)

Description

includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.

Related

Alias · CVE (1)

CVE-2021-38556 includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection. vulnerability

Weakness · CWE (1)

CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References