#VU13344 Command injection in Privileged Access Manager - CVE-2018-9021


Vulnerability identifier: #VU13344

Vulnerability risk: Low

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-9021

CWE-ID: CWE-77

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Privileged Access Manager
Web applications / Remote management & hosting panels

Vendor: CA Technologies

Description

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The weakness exists in the ajax_cmd.php file due to insufficient validation of user-supplied input. A remote attacker can inject and execute arbitrary commands with elevated privileges.

Mitigation
Update to version 3.0.0 or later.

Vulnerable software versions

Privileged Access Manager: before 3.0.0

External links
https://seclists.org/bugtraq/2018/Jun/46

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Multiple vulnerabilities in CA Privileged Access Manager