GHSA-2877-693q-pj33CriticalCVSS 9.8

OS Command Injection in GenieACS

Published
March 7, 2022
Last Modified
February 3, 2023

🔗 CVE IDs covered (1)

CVE-2021-46704 →

📋 Description

In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.

🎯 Affected products1

  • npm/genieacs:< 1.2.8

🔗 References (4)