CVE-2024-1115CWE-78

openBI Setting.php dlfile os command injection

High · published January 31, 2024

CVSS v3.1
7.3
EPSS
2%
Percentile
79.2
In the wild
Unconfirmed
What it is

A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/websocket/controller/Setting.php. The manipulation of the argument phpPath leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252473 was assigned to this vulnerability.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01870 · 79.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2024-01-31T20:00Z
EPSS history
Timeline
  • 31 JAN 20:00Z
    openBI Setting.php dlfile os command injection
    cvelistv5