The web services of Softnext's products, Mail SQR Expert and Mail Archiving Expert do not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the remote server.
References
| Link | Resource |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-7958-817f4-1.html | Third Party Advisory |
| https://www.twcert.org.tw/en/cp-139-7959-09d0e-2.html | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
13 Sep 2024, 15:03
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Softnext sn Os
Softnext |
|
| CPE | cpe:2.3:o:softnext:sn_os:12.1:-:*:*:*:*:*:* cpe:2.3:o:softnext:sn_os:10.3:-:*:*:*:*:*:* cpe:2.3:o:softnext:sn_os:12.3:-:*:*:*:*:*:* |
|
| References | () https://www.twcert.org.tw/tw/cp-132-7958-817f4-1.html - Third Party Advisory | |
| References | () https://www.twcert.org.tw/en/cp-139-7959-09d0e-2.html - Third Party Advisory |
29 Jul 2024, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-29 03:15
Updated : 2024-09-13 15:03
NVD link : CVE-2024-5670
Mitre link : CVE-2024-5670
JSON object : View
Products Affected
softnext
- sn_os
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')