CVE-2024-42166 — Command Injection in Applicationname
The function "generate_app_certificates" in lib/app_certificates.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an …
Published: 2024-08-12 · CVSS: 9.1 · CVSS 3.1
The function "generate_app_certificates" in lib/app_certificates.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious name.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7