RCE in Anl Bcfg2

CVE-2012-3366

The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.038 (89.0th percentile) — read the EPSS interpretation.

Affected products

  • Anl Bcfg2 — versions 1.2.0
  • N/a — versions n/a

Weakness classification (CWE)

References