CVE-2012-0261

Published: Dec 31, 2013Modified: Apr 29, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the timestamp parameter for an install action.

Affected (6)

Products: Op5: Monitor, System Portal

Op5

2 products

Monitor

System Portal

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Op5 Monitor	Up to 5.5.1
Op5 Monitor	Version 5.3.5
Op5 Monitor	Version 5.4.0
Op5 Monitor	Version 5.4.2
Op5 Monitor	Version 5.5.0
Op5 System Portal	Up to 1.6.1

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (12)

http://seclists.org/fulldisclosure/2012/Jan/62

Source: cve@mitre.org

http://secunia.com/advisories/47417

Source: cve@mitre.org

Vendor Advisory

http://www.ekelow.se/file_uploads/Advisories/ekelow-aid-2012-01.pdf

Source: cve@mitre.org

http://www.op5.com/news/support-news/fixed-vulnerabilities-op5-monitor-op5-appliance/

Source: cve@mitre.org

http://www.osvdb.org/78064

Source: cve@mitre.org

https://bugs.op5.com/view.php?id=5094

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2012/Jan/62