CVE-2020-15477

EUVD-2020-7470
The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTortoise.js has no validation on the parameter incomingString before passing it to the child_process.exec function.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Affected Products (NVD)
VendorProductVersion
raspberrytorteraspberrytortoise
𝑥
≤ 2012-10-28
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://gist.github.com/PreethamBomma/e7b6d220790f95555dc2c5ac1d7d2f85
https://github.com/raspberrytorte/tortoise/tree/master/nodejs
https://gist.github.com/PreethamBomma/e7b6d220790f95555dc2c5ac1d7d2f85
https://github.com/raspberrytorte/tortoise/tree/master/nodejs