NVD Vulnerability Detail

CVE-2018-1000666

Summary	GIG Technology NV JumpScale Portal 7 version before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in method: notifySpaceModification; that can result in Improper validation of parameters results in command execution. This attack appear to be exploitable via Network connectivity, required minimal auth privileges (everyone can register an account). This vulnerability appears to have been fixed in After commit 15443122ed2b1cbfd7bdefc048bf106f075becdb.
Publication Date	Sept. 7, 2018, 2:29 a.m.
Registration Date	March 1, 2021, 6:40 p.m.
Last Update	Nov. 21, 2024, 12:40 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:openvcloud_project:openvcloud::::::::					2.3.0

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:gig:jumpscale:7:::::::*

Related information, measures and tools

No	URL	タグ
1	https://github.com/0-complexity/openvcloud/issues/1207	Exploit Issue Tracking Third Party Advisory
2	https://github.com/0-complexity/openvcloud/issues/1207	Exploit Issue Tracking Third Party Advisory
3	https://github.com/jumpscale7/jumpscale_portal/blob/c997bb1824862b08246d60e34e950df06ebac68c/apps/portalbase/system/system__contentmanager/methodclass/system_contentmanager.py#L293-L315	Exploit Third Party Advisory
4	https://github.com/jumpscale7/jumpscale_portal/blob/c997bb1824862b08246d60e34e950df06ebac68c/apps/portalbase/system/system__contentmanager/methodclass/system_contentmanager.py#L293-L315	Exploit Third Party Advisory
5	https://github.com/jumpscale7/jumpscale_portal/pull/108	Broken Link
6	https://github.com/jumpscale7/jumpscale_portal/pull/108	Broken Link
7	https://medium.com/%40vrico315/vulnerability-in-jumpscale-portal-7-a88098a1caca
8	https://medium.com/%40vrico315/vulnerability-in-jumpscale-portal-7-a88098a1caca
9	https://telegra.ph/Description-of-vulnerability-in-JumpScale-Portal-7-08-23	Exploit Third Party Advisory
10	https://telegra.ph/Description-of-vulnerability-in-JumpScale-Portal-7-08-23	Exploit Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-78	OSコマンド・インジェクション	https://cwe.mitre.org/data/definitions/78.html

JVN Vulnerability Information

GIG Technology NV JumpScale Portal における OS コマンドインジェクションの脆弱性

Title	GIG Technology NV JumpScale Portal における OS コマンドインジェクションの脆弱性
Summary	GIG Technology NV JumpScale Portal には、OS コマンドインジェクションの脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Jan. 17, 2018, midnight
Registration Date	Nov. 26, 2018, 3:48 p.m.
Last Update	Nov. 26, 2018, 3:48 p.m.

Affected System

GIG Technology NV

JumpScale Portal 7 commit 15443122ed2b1cbfd7bdefc048bf106f075becdb 未満

openvcloud project

openvcloud

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-1000666	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000666
National Vulnerability Database (NVD)
2	CVE-2018-1000666	https://nvd.nist.gov/vuln/detail/CVE-2018-1000666

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-78	https://jvndb.jvn.jp/ja/cwe/CWE-78.html

ベンダー情報

No	Name	URL
GitHub
1	jumpscale_portal	https://github.com/jumpscale7/jumpscale_portal/blob/c997bb1824862b08246d60e34e950df06ebac68c/apps/portalbase/system/system__contentmanager/methodclass/system_contentmanager.py#L293-L315
2	Some weird feature in portal make portal crash #1207	https://github.com/0-complexity/openvcloud/issues/1207

Change Log

No	Changed Details	Date of change
1	[2018年11月26日] 掲載	Nov. 26, 2018, 3:48 p.m.