title: Hgiga OAKlouds - Command Injection
description: The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.
problem types: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
affected:
{
defaultStatus: unaffected
modules: [OAKlouds-organization-2.0, OAKlouds-organization-3.0]
product: OAKlouds
vendor: Hgiga
versions:
lessThan: 188, status: affected, version:  , versionType: custom
}
{
defaultStatus: unaffected
modules: [OAKlouds-webbase-2.0, OAKlouds-webbase-3.0]
product: OAKlouds
vendor: Hgiga
versions:
lessThan: 1051, status: affected, version:  , versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update OAKlouds-organization-2.0 to 188 or later version
Update OAKlouds-organization-3.0 to 188 or later version
Update OAKlouds-webbase-2.0 to 1051 or later version
Update OAKlouds-webbase-3.0 to 1051 or later version