PT-2022-27314 · Unknown · Object First Ootbi Beta

Published 2022-11-07 · Updated 2025-06-24 · CVE-2022-44794

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Object First Ootbi BETA versions 1.0.7.712 through 1.0.13.1610

Description An issue was discovered in the management protocol, allowing a remote attacker to execute arbitrary Bash code with root privileges. The command that sets the hostname does not validate input parameters, resulting in arbitrary data being sent directly to the Bash interpreter. An attacker would need credentials to exploit this issue.

Recommendations For versions 1.0.7.712 through 1.0.13.1610, update to Object First Ootbi BETA build 1.0.13.1611 to resolve the issue. As a temporary workaround, consider restricting access to the management protocol to minimize the risk of exploitation. Avoid using the hostname setting command until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-44794

Affected Products

Object First Ootbi Beta

References · 6

• https://objectfirst.com/security/of-20221024-0001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-44794 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44794 · Security Note
• https://t.me/cvenotify/126559 · Telegram Post
• https://t.me/cvenotify/37251 · Telegram Post
• https://t.me/cvenotify/37152 · Telegram Post