title: OS Command Injection Vulnerability in Emagic Data Center Management Suite
description: This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. A remote authenticated attacker could exploit this by injecting OS commands on the targeted system.
Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code on targeted system.
problem types: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
affected:
{
vendor: ESDS
product: Emagic Data Center Management Suite
versions:
status: affected, version: 0, lessThanOrEqual: V6.0, versionType: custom
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
]
solutions: Upgrade to Enlight360 Datacenter Management Center Suite with latest version v8.9