CVE-2014-7180 Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, which allows local users to execute arbitrary Perl code by....
MediumCVSS 4.6
EPSS 0.46%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, which allows local users to execute arbitrary Perl code by modifying these files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| electric cloud electriccommander | <= 4.2.5 | No fix listed |
| electric cloud electriccommander | = 5.0.0 | No fix listed |
| electric cloud electriccommander | = 5.0.1 | No fix listed |
| electric cloud electriccommander | = 5.0.2 | No fix listed |
References
- docs.electric-cloud.com vendor-advisory
- packetstormsecurity.com
- 20141023 CVE-2014-7180 - ElectricCommander Local Privilege Escalation mailing-list
- www.secureworks.com exploit
- www.secureworks.com
- 70722 vdb-entry
- electriccom-cve20147180-priv-escalation(97735) vdb-entry