high8.8
CVE-2023-30260
RaspAP raspap-webgui Command Injection vulnerability
Impact
Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | billz/raspap-webgui | < 2.8.9 | 2.8.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Raspap | Raspap | through 2.8.8 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://eldstal.se/advisories/230328-raspap.html
- https://github.com/RaspAP/raspap-webgui/pull/1322
- https://github.com/advisories/GHSA-hhqm-f4m4-pq39
- https://nvd.nist.gov/vuln/detail/CVE-2023-30260
- https://github.com/RaspAP/raspap-webgui/commit/238e1670fcef8b18ec4628ee74fc345607536a16