CVE-2023-22581
White Rabbit Switch - Unauthenticated remote code execution
| CVE | CVE-2023-22581 | |||||||||||
| Title | White Rabbit Switch - Unauthenticated remote code execution | |||||||||||
| Case | DIVD-2022-00068 | |||||||||||
| Credits |
|
|||||||||||
| Affected products |
|
|||||||||||
| CVSS |
Base score:
9.8
(CRITICAL) |
|||||||||||
| References |
|
|||||||||||
| Problem type(s) | CWE-20 Improper Input Validation | |||||||||||
| Impact(s) | CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs | |||||||||||
| Date published | 12 Apr 2023 19:00 UTC | |||||||||||
| Last modified |
Description
White Rabbit Switch contains a vulnerability which makes it possible for an attacker to to perform system commands under the context of the web application (the default installation makes the webserver run as the root user).
Workaround(s)
Upgrade to version 6.0.2
JSON version.