CVE-2023-49565
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-77
Neutralización incorrecta de elementos especiales usados en un comando (Inyección de comando)
Fecha de publicación:
18/09/2025
Última modificación:
18/09/2025
Descripción
*** Pendiente de traducción *** The cbis_manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without adequate validation, enabling a remote attacker to execute arbitrary commands on the underlying system by crafting malicious header values within an HTTP request to the affected endpoint.<br />
The web service executes with root privileges within the container environment, the demonstrated remote code execution permits an attacker to acquire elevated privileges for the command execution.<br />
Restricting access to the management network with an external firewall can partially mitigate this risk.
Impacto
Puntuación base 3.x
8.40
Gravedad 3.x
ALTA