CVE-2015-2746 The network diagnostics tool (CommandLineServlet) in the Appliance Manager command line utility (CLU) in Websense TRITON 7.8.3 and V-Series appliances before 7.8.4 Hotfix 02 allows remote authenticate...
MediumCVSS 6.5
EPSS 25.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The network diagnostics tool (CommandLineServlet) in the Appliance Manager command line utility (CLU) in Websense TRITON 7.8.3 and V-Series appliances before 7.8.4 Hotfix 02 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the "second" parameter of a command, as demonstrated by the Destination parameter in the ping command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| websense triton | = 7.8.3 | No fix listed |
| websense v-series appliances | <= 7.7 | No fix listed |
References
- packetstormsecurity.com exploit
- 20150318 Command injection vulnerability in network diagnostics tool of Websense Appliance Manager mailing-list
- 20150318 Command injection vulnerability in network diagnostics tool of Websense Appliance Manager mailing-list
- www.websense.com vendor-advisory
- 36423 exploit
- www.securify.nl exploit