NVD

Id
81715  
Name
CVE-2016-10043  
Description
An issue was discovered in Radisys MRF Web Panel (SWMS) 9.0.1. The MSM_MACRO_NAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character (|) to inject arbitrary OS commands and retrieve the output in the application"s responses. Attackers could execute unauthorized commands, which could then be used to disable the software, or read, write, and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application"s owner (apache user).  
Reject
 
CVSS Version
2  
CVSS Score
10  
Severity
High  
CVSS Base Score
10  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-03-18  
Published
2017-01-31  
Modified Date
2017-03-13  
Seq
2016-10043  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
404930 81715 CVE-2017-5367 http://seclists.org/bugtraq/2017/Feb/6  View
404931 81715 CVE-2017-5367 http://seclists.org/fulldisclosure/2017/Feb/11  View
404932 81715 CVE-2017-5367 http://seclists.org/bugtraq/2017/Feb/6  View
404933 81715 CVE-2017-5367 http://seclists.org/fulldisclosure/2017/Feb/11  View

Related JVN