CWE Code: 77
Vulnerability Type: privilege_escalation
CVSS Score: 8.5
CWE Name:  Improper Neutralization of Special Elements used in a Command ('Command Injection')
Summary: onapp before 5.0.0-88, 5.5.0-93, and 6.0.0-196 allows an attacker to run arbitrary commands with root privileges on servers managed by onapp for xen/kvm hypervisors. to exploit the vulnerability an attacker has to have control of a single server on a given cloud (e.g. by renting one). from the source server, the attacker can craft any command and trigger the onapp platform to execute that command with root privileges on a target server.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2019-06-19
Last Modified Date: 2019-06-21