SHIRASAGI OS command injection flaw
Anyone logged into the website management tool can hack the server.
Summary
An authenticated attacker in SHIRASAGI can execute arbitrary OS commands on the system running it. Versions v1.19.0 through v1.21.0 are affected.
Affected when
- Attacker holds a login account on SHIRASAGI
What to do
No source names a fixed version. Check that you run a version newer than v1.21.0, and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen