zeroshell Vulnerabilities and Affected Products
Vulnerabilities associated with zeroshell.
Products
Clear product- zeroshell3 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2020-29390CRITICAL | zeroshell zeroshell Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character. | CVSS9.8v3.1 | EPSS40.2% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2019-12725CRITICAL | zeroshell zeroshell Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters. | CVSS9.8v3.0 | EPSS89.8% | PoCs8 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
zeroshell zeroshell Improper Input Validationcgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action. | CVSS10.0v2.0 | EPSS90.4% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |