CVE-2008-5810

WBPublish (aka WBPublish.exe) in Fujitsu-Siemens WebTransactions 7.0, 7.1, and possibly other versions allows remote attackers to execute arbitrary commands via shell metacharacters in input that is sent through HTTP and improperly used during temporary session data cleanup, possibly related to (1) directory names, (2) template names, and (3) session IDs.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
10 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:C/I:C/A:C
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 87%
VendorProductVersion
fujitsu-siemenswebtransactions
7.0
fujitsu-siemenswebtransactions
7.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://bs2www.fujitsu-siemens.de/update/securitypatch.htm#english
http://secunia.com/advisories/33168
http://securityreason.com/securityalert/4856
http://www.sec-consult.com/files/20081219-0_fujitsu-siemens_webta_cmdexec.txt
http://www.securityfocus.com/archive/1/499417/100/0/threaded
http://www.securityfocus.com/bid/32927
http://www.securitytracker.com/id?1021475
http://www.vupen.com/english/advisories/2008/3462
https://exchange.xforce.ibmcloud.com/vulnerabilities/47495
http://bs2www.fujitsu-siemens.de/update/securitypatch.htm#english
http://secunia.com/advisories/33168
http://securityreason.com/securityalert/4856
http://www.sec-consult.com/files/20081219-0_fujitsu-siemens_webta_cmdexec.txt
http://www.securityfocus.com/archive/1/499417/100/0/threaded
http://www.securityfocus.com/bid/32927
http://www.securitytracker.com/id?1021475
http://www.vupen.com/english/advisories/2008/3462
https://exchange.xforce.ibmcloud.com/vulnerabilities/47495