CVE-2024-5337

A vulnerability was found in Ruijie RG-UAC up to 20240516 and classified as critical. This issue affects some unknown processing of the file /view/systemConfig/sys_user/user_commit.php. The manipulation of the argument email2/user_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266243. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Configurations

No configuration.

History

21 Nov 2024, 09:47

Type Values Removed Values Added
References () https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/z%7CYVDv%7CHKA)*%5CdK!/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-sys_user%3Auser_commit.php.pdf - () https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/z%7CYVDv%7CHKA)*%5CdK!/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-sys_user%3Auser_commit.php.pdf -
References () https://vuldb.com/?ctiid.266243 - () https://vuldb.com/?ctiid.266243 -
References () https://vuldb.com/?id.266243 - () https://vuldb.com/?id.266243 -
References () https://vuldb.com/?submit.336032 - () https://vuldb.com/?submit.336032 -

28 May 2024, 12:39

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad fue encontrada en Ruijie RG-UAC hasta 20240516 y clasificada como crítica. Este problema afecta un procesamiento desconocido del archivo /view/systemConfig/sys_user/user_commit.php. La manipulación del argumento correo electrónico2/nombre_usuario conduce a la inyección del comando del sistema operativo. El ataque puede iniciarse de forma remota. El exploit ha sido divulgado al público y puede utilizarse. El identificador asociado de esta vulnerabilidad es VDB-266243. NOTA: Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera.

25 May 2024, 15:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-05-25 15:15

Updated : 2024-11-21 09:47


NVD link : CVE-2024-5337

Mitre link : CVE-2024-5337

CVE.ORG link : CVE-2024-5337


JSON object : View

Products Affected

No product.

CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')