Descripción
Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
Acción recomendada
Aplicar las mitigaciones del fabricante; si no están disponibles, discontinuar el uso del producto.
Referencias
- Aviso de docs.aviatrix.com docs.aviatrix.com/documentation/latest/release-notices/psirt-advisori…
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2024-50603
Otras vulnerabilidades de Aviatrix en el catálogo
- CVE-2021-40870 Aviatrix Controller Unrestricted Upload of File Alta 18-01-2022