Vulnerability in Ledgersmb
CVE-2018-9246
The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create(), run_file(), backup(), or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.
EPSS: 0.026 (83.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Ledgersmb
- Pgobject-util-dbadmin_project Pgobject-util-dbadmin
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-9246?
- CVE-2018-9246 is a critical-severity vulnerability in Ledgersmb, classified under Improper Encoding or Escaping of Output. CVSS score: 9.8/10. Published 2018-06-08.
- How severe is CVE-2018-9246?
- Critical severity. CVSS v3 base score is 9.8 out of 10.