Vulnerability CVE-2018-5347
Published: 2018-01-11   Modified: 2018-01-12

Description:
Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled.

Type:

CWE-78

 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') )

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
10/10
10/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Seagate -> Personal cloud firmware 

 References:
https://blogs.securiteam.com/index.php/archives/3548
https://www.exploit-db.com/exploits/43659/
Copyright 2024, cxsecurity.com

 

Back to Top