CVE-2024-42167 — Command Injection in Organisationname
The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows …
Published: 2024-08-12 · CVSS: 9.1 · CVSS 3.1
The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious organisationname.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7