high7.8
CVE-2021-36667
Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server du…
Impact
Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized call to the python os.system library.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Druva | Insync Client | before 7.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://docs.druva.com/Knowledge_Base/Security_Update/Security_Advisory_for_inSync_Client_7.0.1_and_before
- https://imhotepisinvisible.com/druva-lpe/
- https://docs.druva.com/Knowledge_Base/Security_Update/Security_Advisory_for_inSync_Client_7.0.1_and_before
- https://imhotepisinvisible.com/druva-lpe/