IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.8Yüksek

CVE-2022-0073Authenticated Remote Code Execution in OpenLiteSpeed Web Server

LiteSpeed Technologies OpenLiteSpeed Web Server; LiteSpeed Technologies LiteSpeed Web Server Yayım: (4 yıl önce)

Açıklama

Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. This affects 1.7.0 versions before 1.7.16.1.

Zayıflık türü (CWE): CWE-20

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
LiteSpeed Technologies LiteSpeed Web Server 1.7.0 – < 1.7.16.1
LiteSpeed Technologies OpenLiteSpeed Web Server 1.7.0 – < 1.7.16.1

Kaynaklar ve yamalar

Aynı üründe son açıklar — LiteSpeed / OpenLiteSpeed

9.4Kritik
CVE-2026-93903
litespeedtech LiteSpeed Web Server

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting a low-privileged tenant execute code in the context of a different account.

7.2Yüksek
CVE-2026-31386
LiteSpeed Technologies OpenLiteSpeed; LiteSpeed Technologies LSWS Enterprise

OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.

1.5%EPSS
8.8Yüksek
CVE-2021-47903

LiteSpeed Web Server Enterprise 5.4.11 - Command Injection

LiteSpeed Technologies Inc LiteSpeed Web Server Enterprise

LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, a…

1.6%EPSS
7.2Yüksek
CVE-2021-47855

Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting

LiteSpeed Technologies OpenLiteSpeed

Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripts. Attackers can craft a payload in the Notes field during listener configuration that will execut…