Threats tagged 'ghsa-32xv-355r-2ff6'

IPFire versions prior to 2.29 (Core Update 198) have a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user via the BE_NAME parameter during blacklist installation. The vulnerability arises because the BE_NAME parameter is unsafely interpolated into a shell command without proper sanitization. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.