9.8Critical
KEV
CVE-2022-44877CWP Control Web Panel OS Command Injection Vulnerability
Known exploited — CWP Control Web Panel OS Command Injection Vulnerability
CISA confirmed this vulnerability is used in real attacks on 17.01.2023. Remediation deadline for US federal agencies: 07.02.2023.
Required action: Apply updates per vendor instructions. https://control-webpanel.com/changelog#1669855527714-450fb335-6194; https://nvd.nist.gov/vuln/detail/CVE-2022-44877
Description
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.
Weakness (CWE):
CWE-78
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| control-webpanel | webpanel | < 0.9.8.1147 |
References and patches
- https://www.youtube.com/watch?v=kiLfSvc1SYY ExploitThird Party Advisory
- https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386 ExploitThird Party Advisory
- 20230106 Centos Web Panel 7 Unauthenticated Remote Code Execution - CVE-2022-44877 mailing-listExploitMailing ListThird Party Advisory
- http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-44877 US Government Resource
CPE matches (NVD) (1)
cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:*< 0.9.8.1147