| Package | Affected versions | Patched versions |
|---|---|---|
| opendcim | = 23.04 |
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an attacker can modify the fac_Config.dot value, arbitrary commands may be executed in the context of the web server process.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free