Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manager <=1.8.2. As a result arbitrary commands can be executed on the operating system that is running Peering Manager. This issue has been addressed in version 1.8.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
References
Configurations
History
20 Feb 2025, 17:18
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
| First Time |
Peering-manager
Peering-manager peering Manager |
|
| CWE | NVD-CWE-Other | |
| CPE | cpe:2.3:a:peering-manager:peering_manager:*:*:*:*:*:*:*:* | |
| References | () https://owasp.org/www-community/attacks/Command_Injection - Not Applicable | |
| References | () https://stackoverflow.com/questions/73939573/how-to-sanitise-string-of-python-code-with-python - Not Applicable | |
| References | () https://github.com/peering-manager/peering-manager/security/advisories/GHSA-q37x-qfrx-jcv6 - Exploit, Vendor Advisory | |
| References | () https://github.com/peering-manager/peering-manager/commit/8a865fb596c11ad7caf45aef317d8fcbce7f85ff - Patch | |
| References | () https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/18-Testing_for_Server_Side_Template_Injection - Not Applicable |
12 Mar 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-12 20:15
Updated : 2025-02-20 17:18
NVD link : CVE-2024-28114
Mitre link : CVE-2024-28114
JSON object : View
Products Affected
peering-manager
- peering_manager
CWE