PT-2020-7490 · Unknown · Ajaxplorer

Published 2020-02-11 · Updated 2020-02-12 · CVE-2013-4267

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Ajaxeplorer versions prior to 5.0.1

Description: The issue allows remote attackers to execute arbitrary commands. This can be achieved by injecting shell metacharacters into specific parameters, including the archive name parameter in the Power FS module, a file name in the getTrustSizeOnFileSystem function within the File System (Standard) module, or the revision parameter in the Subversion Repository module.

Recommendations: For versions prior to 5.0.1, update to version 5.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Power FS, File System (Standard), and Subversion Repository modules until the update is applied. Avoid using the archive name, file names in the getTrustSizeOnFileSystem function, and revision parameters in the affected modules until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2013-4267

Affected Products

Ajaxplorer

References · 4

• https://github.com/pydio/pydio-core/commit/22a62840e5ac14bb389 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-4267 · Security Note
• http://openwall.com/lists/oss-security/2013/08/21/16 · Note
• https://tenable.com/plugins/nessus/70495 · Note