CVE-2020-26124

openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because…

published October 2, 2020

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.2th percentile for exploit probability.

CVSS
—
EPSS
65%
Percentile
99.2
In the wild
Unconfirmed
What it is

openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_encode_safe is not used in config/databasebackend.inc. Successful exploitation allows arbitrary command execution on the underlying operating system as root.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.64832 · 99.2th percentile
Published
2020-10-02T08:28Z
EPSS history
Timeline
  • 02 OCT 08:28Z
    openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because…
    cvelistv5