CVE-2018-16144

Description

The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to command injection due to improper sanitization of the rancid_password parameter.

Weakness classification

• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Primary references

• cve@mitre.org — Release Notes, Vendor Advisory
• cve@mitre.org — Release Notes, Vendor Advisory
• cve@mitre.org — Exploit, Mailing List, Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mailing List, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory