CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2024-50603

An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.944

EPSS Ranking 99.9%

CVSS Severity

CVSS v3 Score 10.0

Proposed Action

Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.

Ransomware Campaign

Unknown

References

Products affected by CVE-2024-50603

Aviatrix » Controller » Version: 2.5

cpe:2.3:a:aviatrix:controller:2.5
Aviatrix » Controller » Version: 2.6

cpe:2.3:a:aviatrix:controller:2.6
Aviatrix » Controller » Version: 2.7

cpe:2.3:a:aviatrix:controller:2.7
Aviatrix » Controller » Version: 3.0

cpe:2.3:a:aviatrix:controller:3.0
Aviatrix » Controller » Version: 3.1

cpe:2.3:a:aviatrix:controller:3.1
Aviatrix » Controller » Version: 3.2

cpe:2.3:a:aviatrix:controller:3.2
Aviatrix » Controller » Version: 3.3

cpe:2.3:a:aviatrix:controller:3.3
Aviatrix » Controller » Version: 3.4

cpe:2.3:a:aviatrix:controller:3.4
Aviatrix » Controller » Version: 3.5

cpe:2.3:a:aviatrix:controller:3.5
Aviatrix » Controller » Version: 4.0

cpe:2.3:a:aviatrix:controller:4.0
Aviatrix » Controller » Version: 4.1.914

cpe:2.3:a:aviatrix:controller:4.1.914
Aviatrix » Controller » Version: 4.1.946

cpe:2.3:a:aviatrix:controller:4.1.946
Aviatrix » Controller » Version: 4.2.634

cpe:2.3:a:aviatrix:controller:4.2.634
Aviatrix » Controller » Version: 4.2.740

cpe:2.3:a:aviatrix:controller:4.2.740
Aviatrix » Controller » Version: 4.2.764

cpe:2.3:a:aviatrix:controller:4.2.764
Aviatrix » Controller » Version: 4.3.1230

cpe:2.3:a:aviatrix:controller:4.3.1230
Aviatrix » Controller » Version: 4.3.1262

cpe:2.3:a:aviatrix:controller:4.3.1262
Aviatrix » Controller » Version: 4.3.1275

cpe:2.3:a:aviatrix:controller:4.3.1275
Aviatrix » Controller » Version: 4.6.587

cpe:2.3:a:aviatrix:controller:4.6.587
Aviatrix » Controller » Version: 4.7.378

cpe:2.3:a:aviatrix:controller:4.7.378
Aviatrix » Controller » Version: 4.7.419

cpe:2.3:a:aviatrix:controller:4.7.419
Aviatrix » Controller » Version: 4.7.473

cpe:2.3:a:aviatrix:controller:4.7.473
Aviatrix » Controller » Version: 4.7.494

cpe:2.3:a:aviatrix:controller:4.7.494
Aviatrix » Controller » Version: 4.7.501

cpe:2.3:a:aviatrix:controller:4.7.501
Aviatrix » Controller » Version: 4.7.581

cpe:2.3:a:aviatrix:controller:4.7.581
Aviatrix » Controller » Version: 4.7.590

cpe:2.3:a:aviatrix:controller:4.7.590
Aviatrix » Controller » Version: 5.0.2667

cpe:2.3:a:aviatrix:controller:5.0.2667
Aviatrix » Controller » Version: 5.0.2754

cpe:2.3:a:aviatrix:controller:5.0.2754
Aviatrix » Controller » Version: 5.0.2768

cpe:2.3:a:aviatrix:controller:5.0.2768
Aviatrix » Controller » Version: 5.0.2773

cpe:2.3:a:aviatrix:controller:5.0.2773
Aviatrix » Controller » Version: 5.0.2782

cpe:2.3:a:aviatrix:controller:5.0.2782
Aviatrix » Controller » Version: 5.1.1016

cpe:2.3:a:aviatrix:controller:5.1.1016
Aviatrix » Controller » Version: 5.1.1183

cpe:2.3:a:aviatrix:controller:5.1.1183
Aviatrix » Controller » Version: 5.1.842

cpe:2.3:a:aviatrix:controller:5.1.842
Aviatrix » Controller » Version: 5.1.845

cpe:2.3:a:aviatrix:controller:5.1.845
Aviatrix » Controller » Version: 5.1.935

cpe:2.3:a:aviatrix:controller:5.1.935
Aviatrix » Controller » Version: 5.1.943

cpe:2.3:a:aviatrix:controller:5.1.943
Aviatrix » Controller » Version: 5.1.962

cpe:2.3:a:aviatrix:controller:5.1.962
Aviatrix » Controller » Version: 5.1.969

cpe:2.3:a:aviatrix:controller:5.1.969
Aviatrix » Controller » Version: 5.1.973

cpe:2.3:a:aviatrix:controller:5.1.973
Aviatrix » Controller » Version: 5.1.989

cpe:2.3:a:aviatrix:controller:5.1.989
Aviatrix » Controller » Version: 5.2.1991

cpe:2.3:a:aviatrix:controller:5.2.1991
Aviatrix » Controller » Version: 5.2.2011

cpe:2.3:a:aviatrix:controller:5.2.2011
Aviatrix » Controller » Version: 5.2.2047

cpe:2.3:a:aviatrix:controller:5.2.2047
Aviatrix » Controller » Version: 5.2.2071

cpe:2.3:a:aviatrix:controller:5.2.2071
Aviatrix » Controller » Version: 5.2.2092

cpe:2.3:a:aviatrix:controller:5.2.2092
Aviatrix » Controller » Version: 5.2.2122

cpe:2.3:a:aviatrix:controller:5.2.2122
Aviatrix » Controller » Version: 5.3

cpe:2.3:a:aviatrix:controller:5.3
Aviatrix » Controller » Version: 5.3.1391

cpe:2.3:a:aviatrix:controller:5.3.1391
Aviatrix » Controller » Version: 5.3.1399

cpe:2.3:a:aviatrix:controller:5.3.1399
Aviatrix » Controller » Version: 5.3.1428

cpe:2.3:a:aviatrix:controller:5.3.1428
Aviatrix » Controller » Version: 5.3.1468

cpe:2.3:a:aviatrix:controller:5.3.1468
Aviatrix » Controller » Version: 5.3.1491

cpe:2.3:a:aviatrix:controller:5.3.1491
Aviatrix » Controller » Version: 5.3.1499

cpe:2.3:a:aviatrix:controller:5.3.1499
Aviatrix » Controller » Version: 5.3.1516

cpe:2.3:a:aviatrix:controller:5.3.1516
Aviatrix » Controller » Version: 5.3.1524

cpe:2.3:a:aviatrix:controller:5.3.1524
Aviatrix » Controller » Version: 5.4.1066

cpe:2.3:a:aviatrix:controller:5.4.1066
Aviatrix » Controller » Version: 5.4.1074

cpe:2.3:a:aviatrix:controller:5.4.1074
Aviatrix » Controller » Version: 5.4.1140

cpe:2.3:a:aviatrix:controller:5.4.1140
Aviatrix » Controller » Version: 5.4.1201

cpe:2.3:a:aviatrix:controller:5.4.1201
Aviatrix » Controller » Version: 5.4.1204

cpe:2.3:a:aviatrix:controller:5.4.1204
Aviatrix » Controller » Version: 5.4.1232

cpe:2.3:a:aviatrix:controller:5.4.1232
Aviatrix » Controller » Version: 5.4.1234

cpe:2.3:a:aviatrix:controller:5.4.1234
Aviatrix » Controller » Version: 5.4.1238

cpe:2.3:a:aviatrix:controller:5.4.1238
Aviatrix » Controller » Version: 6.0

cpe:2.3:a:aviatrix:controller:6.0
Aviatrix » Controller » Version: 7.1.1710

cpe:2.3:a:aviatrix:controller:7.1.1710
Aviatrix » Controller » Version: 7.1.1906

cpe:2.3:a:aviatrix:controller:7.1.1906
Aviatrix » Controller » Version: 7.1.2131

cpe:2.3:a:aviatrix:controller:7.1.2131
Aviatrix » Controller » Version: 7.1.3006

cpe:2.3:a:aviatrix:controller:7.1.3006
Aviatrix » Controller » Version: 7.1.3176

cpe:2.3:a:aviatrix:controller:7.1.3176
Aviatrix » Controller » Version: 7.1.3956

cpe:2.3:a:aviatrix:controller:7.1.3956
Aviatrix » Controller » Version: 7.1.3958

cpe:2.3:a:aviatrix:controller:7.1.3958
Aviatrix » Controller » Version: 7.1.4101

cpe:2.3:a:aviatrix:controller:7.1.4101
Aviatrix » Controller » Version: 7.1.4105

cpe:2.3:a:aviatrix:controller:7.1.4105
Aviatrix » Controller » Version: 7.1.4139

cpe:2.3:a:aviatrix:controller:7.1.4139
Aviatrix » Controller » Version: 7.1.4183

cpe:2.3:a:aviatrix:controller:7.1.4183
Aviatrix » Controller » Version: 7.2

cpe:2.3:a:aviatrix:controller:7.2
Aviatrix » Controller » Version: 7.2.4820

cpe:2.3:a:aviatrix:controller:7.2.4820

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2024-50603

Products

Pricing

Contact Us