CVE-2024-26260 - OpenCVE

The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96
https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2024-02-15T02:18:34.668Z

Updated: 2024-08-21T15:28:01.013Z

Reserved: 2024-02-15T01:33:48.679Z

Link: CVE-2024-26260

Vulnrichment

Updated: 2024-08-02T00:07:17.865Z

NVD

Status : Awaiting Analysis

Published: 2024-02-15T03:15:34.833

Modified: 2024-06-28T02:15:03.190

Link: CVE-2024-26260

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-26260", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2024-02-15T01:33:48.679Z", "datePublished": "2024-02-15T02:18:34.668Z", "dateUpdated": "2024-08-21T15:28:01.013Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["OAKlouds-organization-2.0", "OAKlouds-organization-3.0"], "product": "OAKlouds", "vendor": "Hgiga", "versions": [{"lessThan": "188", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["OAKlouds-webbase-2.0", "OAKlouds-webbase-3.0"], "product": "OAKlouds", "vendor": "Hgiga", "versions": [{"lessThan": "1051", "status": "affected", "version": "earlier", "versionType": "custom"}]}], "datePublic": "2024-02-15T02:17:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission."}], "value": "The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission."}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-06-28T02:06:33.958Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.html"}, {"tags": ["third-party-advisory"], "url": "https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update OAKlouds-organization-2.0 to 188 or later version <br>Update OAKlouds-organization-3.0 to 188 or later version <br>Update OAKlouds-webbase-2.0 to 1051 or later version <br>Update OAKlouds-webbase-3.0 to 1051 or later version"}], "value": "Update OAKlouds-organization-2.0 to 188 or later version \nUpdate OAKlouds-organization-3.0 to 188 or later version \nUpdate OAKlouds-webbase-2.0 to 1051 or later version \nUpdate OAKlouds-webbase-3.0 to 1051 or later version"}], "source": {"advisory": "TVN-202402002", "discovery": "EXTERNAL"}, "title": "Hgiga OAKlouds - Command Injection", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:17.865Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.html"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96"}]}, {"affected": [{"vendor": "hgiga", "product": "oaklouds", "cpes": ["cpe:2.3:a:hgiga:oaklouds:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "188", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "1051", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-21T15:11:15.243128Z", "id": "CVE-2024-26260", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T15:28:01.013Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.html", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96", "tags": ["third-party-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:17.865Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26260", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-21T15:11:15.243128Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:hgiga:oaklouds:*:*:*:*:*:*:*:*"], "vendor": "hgiga", "product": "oaklouds", "versions": [{"status": "affected", "version": "0", "lessThan": "188", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "1051", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T15:18:31.920Z"}}], "cna": {"title": "Hgiga OAKlouds - Command Injection", "source": {"advisory": "TVN-202402002", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hgiga", "modules": ["OAKlouds-organization-2.0", "OAKlouds-organization-3.0"], "product": "OAKlouds", "versions": [{"status": "affected", "version": "earlier", "lessThan": "188", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Hgiga", "modules": ["OAKlouds-webbase-2.0", "OAKlouds-webbase-3.0"], "product": "OAKlouds", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1051", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update OAKlouds-organization-2.0 to 188 or later version \nUpdate OAKlouds-organization-3.0 to 188 or later version \nUpdate OAKlouds-webbase-2.0 to 1051 or later version \nUpdate OAKlouds-webbase-3.0 to 1051 or later version", "supportingMedia": [{"type": "text/html", "value": "Update OAKlouds-organization-2.0 to 188 or later version <br>Update OAKlouds-organization-3.0 to 188 or later version <br>Update OAKlouds-webbase-2.0 to 1051 or later version <br>Update OAKlouds-webbase-3.0 to 1051 or later version", "base64": false}]}], "datePublic": "2024-02-15T02:17:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.", "supportingMedia": [{"type": "text/html", "value": "The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-06-28T02:06:33.958Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26260", "state": "PUBLISHED", "dateUpdated": "2024-08-21T15:28:01.013Z", "dateReserved": "2024-02-15T01:33:48.679Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2024-02-15T02:18:34.668Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}