CVE-2023-49565
Severity CVSS v4.0:
Pending analysis
Type:
CWE-77
Command Injection
Publication date:
18/09/2025
Last modified:
18/09/2025
Description
The cbis_manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without adequate validation, enabling a remote attacker to execute arbitrary commands on the underlying system by crafting malicious header values within an HTTP request to the affected endpoint.<br />
The web service executes with root privileges within the container environment, the demonstrated remote code execution permits an attacker to acquire elevated privileges for the command execution.<br />
Restricting access to the management network with an external firewall can partially mitigate this risk.
Impact
Base Score 3.x
8.40
Severity 3.x
HIGH