Description
Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| Controller | Aviatrix / Controller | >= 0, < 7.1.4191 | affected |
| Controller | Aviatrix / Controller | >= 7.2.0, < 7.2.4996 | affected |