Command injection vulnerability - CVE-2016-1450
Published: July 15, 2016 / Updated: July 18, 2016
Vulnerability identifier: #VU155
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-1450
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to execute arbitrary commands on the target system.
The vulnerability exists due to the expectation of a certain file type during an upload. A remote authenticated attacker can execute arbitrary commands by injecting specially crafted command arguments.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
The vulnerability exists due to the expectation of a certain file type during an upload. A remote authenticated attacker can execute arbitrary commands by injecting specially crafted command arguments.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
How to mitigate CVE-2016-1450
Patch for this vulnerability id available through the Cisco Bug Search Tool.