How severe is CVE-2019-17562?

This vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8 out of 10.

What type of vulnerability is CVE-2019-17562?

This is classified as CWE-119, which is a common weakness in software security.

CVE-2019-17562 - CRITICAL Severity | CVSS 9.8

Vulnerability Description

A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. This applies to all versions prior to 4.13.1. The vulnerability is due to the lack of validation of the mac parameter in baremetal virtual router. If you insert an arbitrary shell command into the mac parameter, v-router will process the command. For example: Normal: http://{GW}:10086/baremetal/provisiondone/{mac}, Abnormal: http://{GW}:10086/baremetal/provisiondone/#';whoami;#. Mitigation of this issue is an upgrade to Apache CloudStack 4.13.1.0 or beyond.

Related Vulnerabilities

CVE-1999-1588

CRITICAL

CVSS:9.8(Critical)

Buffer overflow in nlps_server in Sun Solaris x86 2.4, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code as root via a long string beginning with "NLPS:002:002:" to the listen (aka Syst...

CWE-1191999

CVE-2005-3590

CRITICAL

CVSS:9.8(Critical)

The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specified array size is zero, leading to a buff...

CWE-1192005

CVE-2007-5199

CRITICAL

CVSS:9.8(Critical)

A single byte overflow in catalogue.c in X.Org libXfont 1.3.1 allows remote attackers to have unspecified impact.

CWE-1192007

CVE-2007-5341

CRITICAL

CVSS:9.8(Critical)

Remote code execution in the Venkman script debugger in Mozilla Firefox before 2.0.0.8.

CWE-1192007

CVE-2007-6762

CRITICAL

CVSS:9.8(Critical)

In the Linux kernel before 2.6.20, there is an off-by-one bug in net/netlabel/netlabel_cipso_v4.c where it is possible to overflow the doi_def->tags[] array.

CWE-1192007

CVE-2008-3465

CRITICAL

CVSS:9.8(Critical)

Heap-based buffer overflow in an API in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows context-dependent attackers to cause a de...

CWE-1192008