CVE-2020-10221 — rConfig OS Command Injection Vulnerability

provenance: imported · CVE: CVE-2020-10221

CVE-2020-10221: rConfig OS Command Injection Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	rConfig
Product	rConfig
Date added	2021-11-03
Due date	2022-05-03
Ransomware campaign use	Unknown

Description

rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter.

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2020-10221

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-10221
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog