PT-2024-22225 · Webproxy · Webproxy

Published 2024-03-26 · Updated 2024-08-02 · CVE-2024-28033

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WebProxy versions 1.7.8 through 1.7.9

Description An OS command injection issue exists, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the privilege of the running web server.

Recommendations For versions 1.7.8 and 1.7.9, consider stopping the use of these versions as the developer is unreachable and no fix is available. As a temporary workaround, consider restricting access to the web server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-28033

Affected Products

Webproxy

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-28033 · Security Note
• https://twitter.com/VulmonFeeds/status/1772597912293228853 · Twitter Post
• https://t.me/cvenotify/74658 · Telegram Post
• https://jvn.jp/en/jp/JVN22376992 · Note
• https://twitter.com/RedPacketSec/status/1772564973727727980 · Twitter Post
• https://twitter.com/CVEnew/status/1772562208741789820 · Twitter Post