VULNERABILITY INTELLIGENCE

CVE-2024-41661

EPSS probability13.54%

CISA KEVNot currently listed

Published2024-07-23

Last modified2024-08-29

Description

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.