CVE-2018-12317

OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2018-12-04

Last modified

2024-08-05

Weaknesses

CWE-78

Affected products

• Data Master (Asustor)

References

• https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc