CVE-2024-28114

CVSS V2 None CVSS V3 None

Description

Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manager <=1.8.2. As a result arbitrary commands can be executed on the operating system that is running Peering Manager. This issue has been addressed in version 1.8.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Overview

CVE ID
CVE-2024-28114

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-03-12T19:58:39.859Z

Last Modified Date
2024-03-12T19:58:39.859Z

Weakness Enumerations

CWE	URL
CWE-74	http://cwe.mitre.org/data/definitions/74.html

References

Reference URL	Reference Tags
https://github.com/peering-manager/peering-manager/security/advisories/GHSA-q37x-qfrx-jcv6	x_refsource_CONFIRM
https://github.com/peering-manager/peering-manager/commit/8a865fb596c11ad7caf45aef317d8fcbce7f85ff	x_refsource_MISC
https://owasp.org/www-community/attacks/Command_Injection	x_refsource_MISC
https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/18-Testing_for_Server_Side_Template_Injection	x_refsource_MISC
https://stackoverflow.com/questions/73939573/how-to-sanitise-string-of-python-code-with-python	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-28114
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28114

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 07:50:50				Added to TrackCVE