CVE-2024-38288

EUVD-2024-37248
A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated attackers with administrator privileges to execute arbitrary commands on the underlying server as root.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 98%
Affected Products (NVD)
VendorProductVersion
rhubcomturbomeeting
𝑥
< 8.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/google/security-research/security/advisories/GHSA-gx6g-8mvx-3q5c
https://www.rhubcom.com/v5/manuals.html
https://github.com/google/security-research/security/advisories/GHSA-gx6g-8mvx-3q5c
https://www.rhubcom.com/v5/manuals.html