CVE-2020-15477

Katalog CVE

CVSS 9.8 · Critical EPSS 5,0%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada raspberrytorte raspberrytortoise. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTortoise.js has no validation on the parameter incomingString before passing it to the child_process.exec function.

Rincian

Terbit di NVD

23 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

5,0% peluang dieksploitasi; lebih tinggi dari 92,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/PreethamBomma/e7b6d220790f95555dc2c5ac1d7d2f85 exploit · advisory pihak ketiga
• https://github.com/raspberrytorte/tortoise/tree/master/nodejs exploit · advisory pihak ketiga