critical9.8Public exploit code
CVE-2018-5347
Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Seagate Personal Cloud - Multiple Vulnerabilities2018-01-11 · remote · hardware
Impact
Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Seagate | Personal Cloud Firmware | All versions |