Vulnerability Description
An issue was discovered in Object First Ootbi BETA build 1.0.7.712. Management protocol has a flow which allows a remote attacker to execute arbitrary Bash code with root privileges. The command that sets the hostname doesn't validate input parameters. As a result, arbitrary data goes directly to the Bash interpreter. An attacker would need credentials to exploit this vulnerability. This is fixed in Object First Ootbi BETA build 1.0.13.1611.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Objectfirst | Ootbi | < 1.0.13.1611 |
Related Weaknesses (CWE)
References
- https://objectfirst.com/security/of-20221024-0001/Vendor Advisory
- https://objectfirst.com/security/of-20221024-0001/Vendor Advisory
FAQ
What is CVE-2022-44794?
CVE-2022-44794 is a vulnerability with a CVSS score of 8.8 (HIGH). An issue was discovered in Object First Ootbi BETA build 1.0.7.712. Management protocol has a flow which allows a remote attacker to execute arbitrary Bash code with root privileges. The command that ...
How severe is CVE-2022-44794?
CVE-2022-44794 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-44794?
Check the references section above for vendor advisories and patch information. Affected products include: Objectfirst Ootbi.