CVE-2008-1331 cgi-data/FastJSData.cgi in OmniPCX Office with Internet Access services OXO210 before 210/091.001, OXO600 before 610/014.001, and other versions, allows remote attackers to execute arbitrary commands....
HighCVSS 10.0
EPSS 8.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
cgi-data/FastJSData.cgi in OmniPCX Office with Internet Access services OXO210 before 210/091.001, OXO600 before 610/014.001, and other versions, allows remote attackers to execute arbitrary commands and "obtain OXO resources" via shell metacharacters in the id2 parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| alcatel-lucent omnipcx office | >= 210, < 210\/091.001 | 210\/091.001 |
| alcatel-lucent omnipcx office | >= 610, < 610\/014.001 | 610\/014.001 |
References
- 29798 third-party-advisory
- 20080521 [DSECRG-08-020] Alcatel OmniPCX Office Remote Comand Execution mailing-list third-party-advisory vdb-entry
- 28758 third-party-advisory vdb-entry
- 1020082 third-party-advisory vdb-entry
- ADV-2008-1057 permissions-required vdb-entry
- www1.alcatel-lucent.com vendor-advisory
- omnipcx-cgiscript-info-disclosure(41560) third-party-advisory vdb-entry
- 5662 exploit third-party-advisory vdb-entry